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Abstract 

Belief  change  is  a  fundamental  problem  in  AI:  Agents  constantly  have  to  update 
their  beliefs  to  accommodate  new  observations.  In  recent  years,  there  has  been 
much  work  on  axiomatic  characterizations  of  belief  change.  We  claim  that  a  better 
understanding  of  belief  change  can  be  gained  from  examining  appropriate  semantic 
models.  In  this  paper  we  propose  a  general  framework  in  which  to  model  belief 
change.  We  begin  by  defining  belief  in  terms  of  knowledge  and  plausibility:  an  agent 
believes  <fi  if  he  knows  that  <fi  is  more  plausible  than  -xf>.  We  then  consider  some 
properties  defining  the  interaction  between  knowledge  and  plausibility,  and  show 
how  these  properties  affect  the  properties  of  belief.  In  particular,  we  show  that 
by  assuming  two  of  the  most  natural  properties,  belief  becomes  a  KD45  operator. 
Finally,  we  add  time  to  the  picture.  This  gives  us  a  framework  in  which  we  can 
talk  about  knowledge,  plausibility  (and  hence  belief),  and  time,  which  extends  the 
framework  of  Halpern  and  Fagin  for  modeling  knowledge  in  multi-agent  systems. 
We  then  examine  the  problem  of  “minimal  change” .  This  notion  can  be  captured  by 
using  prior  plausibilities,  an  analogue  to  prior  probabilities,  which  can  be  updated 
by  “conditioning” .  We  show  by  example  that  conditioning  on  a  plausibility  measure 
can  capture  many  scenarios  of  interest.  In  a  companion  paper,  we  show  how  the  two 
best-studied  scenarios  of  belief  change,  belief  revision  and  belief  update ,  fit  into  our 
framework. 
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1  Introduction 


In  order  to  act  in  the  world  we  must  make  assumptions,  such  as  “the  corridor  is  clear”  or 
“my  car  is  parked  where  I  left  it” .  These  assumptions,  however,  are  defeasible.  We  can  easily 
imagine  situations  where  the  corridor  is  blocked,  or  where  the  car  is  stolen.  We  call  the 
logical  consequences  of  such  defeasible  assumptions  beliefs.  As  time  passes,  we  constantly 
obtain  new  information  that  might  cause  us  to  make  additional  assumptions  or  withdraw 
some  of  our  previous  assumptions.  The  problem  of  belief  change  is  to  understand  how  beliefs 
should  change. 

The  study  of  belief  change  has  been  an  active  area  in  philosophy  and  in  artificial  intelli¬ 
gence  [Gar88,KM91a].  In  the  literature,  two  instances  of  this  general  phenomenon  have  been 
studied  in  detail:  Belief  revision  [AGM85,Gar88]  attempts  to  describe  how  an  agent  should 
accommodate  a  new  belief  (possibly  inconsistent  with  his  other  beliefs)  about  a  static  world. 
Belief  update  [KM91a],  on  the  other  hand,  attempts  to  describe  how  an  agent  should  change 
his  beliefs  as  a  result  of  learning  about  a  change  in  the  world.  Belief  revision  and  belief  update 
describe  only  two  of  the  many  ways  in  which  beliefs  can  change.  Our  goal  is  to  construct  a 
framework  to  reason  about  belief  change  in  general.  This  paper  describes  the  details  of  that 
framework.  In  a  companion  paper  [FH97a]  we  consider  the  special  cases  of  belief  revision 
and  update  in  more  detail. 

Perhaps  the  most  straightforward  approach  to  belief  change  is  to  simply  represent  an  agent’s 
beliefs  as  a  closed  set  of  formulas  in  some  language  and  then  put  constraints  on  how  these 
beliefs  can  change.  This  is  essentially  the  approach  taken  in  [AGM85,Gar88,KM91a];  as  their 
results  show,  much  can  be  done  with  this  framework.  The  main  problem  with  this  approach 
is  that  it  does  not  provide  a  good  semantics  for  belief.  As  we  hope  to  show  in  this  paper 
and  in  [FH97a],  such  a  semantics  can  give  us  a  much  deeper  understanding  of  how  and  why 
beliefs  change.  Moreover,  this  semantics  provides  the  tools  to  deal  with  complicating  factors 
such  actions,  external  events,  and  multiple  agents. 

One  standard  approach  to  giving  semantics  to  beliefs  is  to  put  a  preference  ordering  on 
the  set  of  worlds  that  the  agent  considers  possible.  Intuitively,  such  an  ordering  captures 
the  relative  likelihood  of  worlds.  Various  authors  [Bou92,GP92,KM91a,Spo88]  have  then 
interpreted  “the  agent  believes  </>”  as  “</>  is  true  in  the  most  plausible  worlds  that  the  agent 
considers  possible” .  An  alternative  approach  is  to  put  a  probability  measure  over  the  set 
of  possible  worlds.  Then  we  can  interpret  “the  agent  believes  </>”  as  “the  probability  of  </>  is 
close  to  1”  [Pea89] .  We  examine  a  new  approach  to  modeling  uncertainty  based  on  plausibility 
i measures ,  introduced  in  [FH95,FH97b],  where  a  plausibility  measure  just  associates  with  an 
event  (i.e.,  a  set  of  possible  worlds)  its  plausibility,  an  element  in  some  partially  ordered  set. 
This  approach  is  easily  seen  to  generalize  other  approaches  to  modeling  uncertainty,  such 


in  Proceedings  of  the  5th  Conference  on  Theoretical  Aspects  of  Reasoning  About  Knowledge ,  1994, 
pp.  44-64,  under  the  title  “A  knowledge-based  framework  for  belief  change,  Part  I:  Foundations”. 
This  version  is  almost  identical  to  one  that  will  appear  in  Artificial  Intelligence. 


2 


as  probability  measures,  belief  functions,  and  preference  orderings.  We  interpret  the  “agent 
believes  ft'  as  “the  plausibility  of  (f>  is  greater  than  that  of  ->ft' .  As  we  show,  this  is  often 
(but  not  always)  equivalent  to  “</>  is  true  in  the  most  plausible  worlds” . 

By  modeling  beliefs  in  this  way,  there  is  an  assumption  that  the  plausibility  measure  is  part  of 
the  agent’s  epistemic  state.  (This  assumption  is  actually  made  explicitly  in  [Bou92,KLM90].) 
This  implies  that  the  plausibility  measure  is  subjective ,  that  is,  it  describes  the  agent’s 
estimate  of  the  plausibility  of  each  event.  But  actually,  an  even  stronger  assumption  is 
being  made:  namely,  that  the  agent’s  epistemic  state  is  characterized  by  a  single  plausibility 
measure.  We  feel  that  this  latter  assumption  makes  the  models  less  expressive  than  they 
ought  to  be.  In  particular,  they  cannot  represent  a  situation  where  the  agent  is  not  sure 
about  what  is  plausible,  such  as  “Alice  does  not  know  that  it  typically  does  not  rain  in 
San  Francisco  in  the  summer”.  To  capture  this,  we  need  to  allow  Alice  to  consider  several 
plausibility  measures  possible;  in  some  it  typically  does  not  rain  and  in  others  it  typically 
does. 1  As  we  shall  see,  this  extra  expressive  power  is  necessary  to  capture  some  interesting 
scenarios  of  belief  change. 

To  deal  with  this,  in  addition  to  plausibility  measures,  we  add  a  standard  accessibility  relation 
to  represent  knowledge.  Once  we  have  knowledge  in  the  picture,  we  define  belief  by  saying 
that  an  agent  believes  <fi  if  she  knows  that  (f>  is  typically  true.  That  is,  according  to  all  the 
plausibility  measures  she  considers  possible,  <fi  is  more  plausible  than  -k/>. 

The  properties  of  belief  depend  on  how  the  plausibility  measure  interacts  with  the  acces¬ 
sibility  relation  that  defines  knowledge.  We  study  these  interactions,  keeping  in  mind  that 
plausibility  generalizes  probability.  In  view  of  this,  it  is  perhaps  not  surprising  that  many 
of  the  issues  studied  by  Fagin  and  Halpern  [FH94a]  when  considering  the  interaction  of 
knowledge  and  probability  also  arise  in  our  framework.  There  are,  however,  a  number  of  new 
issues  that  arise  in  our  framework  due  to  the  interaction  between  knowledge  and  belief.  As 
we  shall  see,  if  we  take  what  are  perhaps  the  most  natural  restrictions  on  this  interaction,  our 
notion  of  belief  is  characterized  by  the  axioms  of  the  modal  logic  KD45  (where  an  agent  has 
complete  introspective  knowledge  about  her  beliefs,  but  may  have  false  beliefs).  Moreover, 
the  interaction  between  knowledge  and  belief  satisfies  the  standard  properties  considered 
by  Kraus  and  Lehmann  [KL88] .  Although  our  major  goal  is  not  an  abstract  study  of  the 
properties  of  knowledge  and  belief,  we  view  the  fact  that  we  have  a  concrete  interpretation 
under  which  these  properties  can  be  studied  to  be  an  important  side-benefit  of  our  approach. 

Having  a  notion  of  belief  is  not  enough  in  order  to  study  belief  change.  We  want  a  framework 
that  captures  the  beliefs  of  the  agent  before  and  after  the  change.  This  is  achieved  by 
introducing  time  explicitly  into  the  framework.  The  resulting  framework  is  an  extension  of 
the  framework  of  Halpern  and  Fagin  [HF89]  for  modeling  knowledge  in  multi-agent  systems, 
and  allows  to  talk  about  knowledge,  plausibility  (and  hence  belief),  and  time.  This  framework 
is  analogous  to  combination  of  knowledge,  probability  and  time  studied  in  [HT93].  As  we 


1  In  fact,  this  issue  is  discussed  by  Boutilier  [Bou92],  although  his  framework  does  not  allow  him 
to  represent  such  a  situation. 
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show  by  example,  having  knowledge,  plausibility,  and  time  represented  explicitly  gives  us  a 
powerful  and  expressive  framework  for  capturing  belief  change. 


This  framework  is  particularly  suited  to  studying  how  plausibility  changes  over  time.  One 
important  intuition  we  would  like  to  capture  is  that  of  minimal  change.  Suppose  an  agent- 
gets  new  information  at  time  t.  Certainly  we  would  expect  his  plausibility  assessment  (and 
his  beliefs)  at  time  t  +  1  to  incorporate  this  new  information;  otherwise,  we  would  expect  his 
assessment  at  time  t  +  1  to  have  changed  minimally  from  his  assessment  at  time  t.  In  prob¬ 
abilistic  reasoning,  it  can  be  argued  that  conditioning  captures  this  intuition.  Conditioning 
incorporates  the  new  information  by  giving  it  probability  1.  Moreover,  the  relative  probability 
of  all  events  consistent  with  the  new  information  is  the  same  before  and  after  conditioning, 
so,  in  this  sense,  conditioning  changes  things  minimally.  We  focus  here  on  a  plausibilistic 
analogue  of  conditioning  and  argue  that  it  captures  the  intuition  of  minimal  change  in  plau¬ 
sibilities.  We  can  then  proceed  much  in  the  spirit  of  the  Bayesian  approach,  but  starting  with 
a  prior  plausibility  and  conditioning.  As  we  show,  many  situations  previously  studied  in  the 
literature,  such  as  diagnostic  reasoning  [Rei87],  can  be  easily  captured  by  using  such  prior 
plausibilities.  Moreover,  as  we  show  in  a  companion  paper  [FH97a],  belief  revision  and  belief 
update — which  both  attempt  to  capture  intuitions  involving  minimal  change  in  beliefs — can 
be  captured  in  our  framework  by  conditioning  on  an  appropriate  prior  plausibility  measure. 
Thinking  in  terms  of  priors  also  gives  us  insight  into  other  representations  of  belief  change, 
such  as  those  of  [Bou94b,GP92,LS94], 

The  rest  of  this  paper  is  organized  as  follows.  In  the  next  section,  we  review  the  syntax  and 
semantics  of  the  standard  approach  to  modeling  knowledge  using  Kripke  structures  and  show 
how  plausibility  can  be  added  to  the  framework.  Much  of  our  technical  discussion  of  axiom- 
atizations  and  decision  procedures  is  closely  related  to  that  of  [FH94a].  In  Section  3.1,  we 
present  our  full  framework  which  adds  plausibility  to  the  framework  of  [HF89]  for  modeling 
knowledge  (and  time)  in  multi-agent  systems.  In  Section  4  we  introduce  prior  plausibilities 
and  show  how  they  can  be  used.  We  conclude  in  Section  5  with  some  discussion  of  the  general 
approach.  Proofs  of  theorems  are  given  in  Appendix  A. 


2  Knowledge  and  Plausibility 


In  this  section,  we  briefly  review  the  standard  models  for  knowledge  and  beliefs  (see  [HM92] 
for  further  motivation  and  details),  describe  a  notion  of  plausibility,  and  then  show  how  to 
combine  the  two  notions.  Finally,  we  compare  the  derived  notion  of  belief  with  previous  work 
on  the  subject. 
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2. 1  The  Logic  of  Knowledge 


We  start  by  examining  the  standard  models  for  knowledge  and  belief.  The  syntax  for  the  logic 
of  knowledge  is  simple:  we  start  with  primitive  propositions  and  close  off  under  conjunction, 
negation,  and  the  modal  operators  Kx, . . . ,  Kn.  A  formula  such  as  Kpp  is  read  “agent  i  knows 
(/>”.  The  logic  of  belief  is  the  result  of  replacing  the  Kt  operator  by  B,.  The  formula,  Bi<p  is 
read  “agent  i  believes  <pv .  The  resulting  languages  are  denoted  CK  and  CB ,  respectively. 

The  semantics  for  these  languages  is  given  by  means  of  Kripke  structures.  A  Kripke  structure 
for  knowledge  (or  belief)  is  a  tuple  (IT,  7r,  /Ci , . . . ,  ]Cn),  where  IT  is  a  set  of  possible  worlds, 
7r (w)  is  a  truth  assignment  to  the  primitive  propositions  at  world  w  G  IT,  and  the  JCfs  are 
accessibility  relations  on  the  worlds  in  W.  For  convenience,  we  define  fCjfw)  =  {w'  :  (w,  w')  G 
JCj}.  Intuitively,  K-fw)  describes  the  set  of  worlds  that  agent  i  considers  possible  in  w.  We 
say  that  agent  i  knows  (or  believes)  (p  at  world  w,  if  all  the  worlds  fCjfw)  satisfy  <f>. 

We  assign  truth  values  to  formulas  at  each  world  in  the  structure.  We  write  ( M ,  w)  |=  <p  if 
the  formula  <p  is  true  at  a  world  w  in  the  Kripke  structure  M. 

•  ( M ,  w)  |=  p  for  a  primitive  proposition  p  if  tv (w)(p)  =  true, 

•  ( M,w )  |=  ~i(f)  if  ( M,w )  <f>, 

•  (M,  w)  |=  <j)  A  ip  if  (M,  w)  \=  <j)  and  (M,  w)  \=  ip, 

•  (M,  w)  |=  I<i(p  if  (M,  w')  \=  <p  for  all  w'  G  fCjfw). 

The  last  clause  captures  the  intuition  that  <p  is  known  exactly  when  it  is  true  in  all  possible 
worlds.  When  considering  the  language  of  beliefs  CB ,  we  typically  use  Bt  rather  than  fCt  to 
denote  the  accessibility  relations.  The  truth  condition  for  Bif>  is  exactly  the  same  as  for  Kj(p. 

Let  M-k  be  the  class  of  Kripke  structures  described  above.  We  say  that  <p  G  CK  is  valid 
in  some  M  G  M.k  if  (M,  w)  \=  <p  for  all  w  in  M.  We  say  that  <p  G  CK  is  valid  in  M.K  if 
it  is  valid  in  all  models  M  G  A ix-  We  say  that  <p  is  satisfiable  in  A4k  if  there  is  a  model 
M  G  Ai k  and  world  w  such  that  (M,  w)  \=  (p. 

The  definition  of  Kripke  structure  does  not  put  any  restriction  on  the  /C,  relations.  By 
imposing  conditions  on  the  /C,  relations  we  get  additional  properties  of  knowledge  (or  belief). 
These  properties  are  captured  by  systems  of  axioms  that  describe  the  valid  formulas  in  classes 
of  structures  that  satisfy  various  constraints  of  interest.  We  briefly  describe  these  systems  and 
the  corresponding  constraints  on  the  accessibility  relations.  Consider  the  following  axioms 
and  rules: 

Kl.  All  substitution  instances  of  propositional  tautologies 
K2.  K,cp  A  Ki(<p  =>ip)=>  I<iip 
K3.  K:t (p  =A  (p 
K4.  K:o  -  KJucP 
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K5.  ~i Ki4>  => 

K6.  -i Kifalse 

RK1.  From  (f>  and  <f>  =>  ip  infer  i (j 
RK2.  From  <f>  infer  K,t(f) 

The  system  K  contains  the  axioms  K1  and  K2  and  the  rules  of  inference  RK1  and  RK2.  By 
adding  axioms  K4  and  K5  we  get  system  K45;  if  in  addition  we  add  axiom  K6  we  get  system 
KD45;  if  instead  we  add  axiom  K3  to  K45  we  get  the  axiom  system  known  as  S5. 

We  now  relate  these  axiom  systems  with  restrictions  on  the  accessibility  relations.  We  start 
with  some  definitions.  A  relation  7 Z  on  W  is  Euclidean  if  (x,y),(x,z)  G  7 Z  implies  that 
(y,  z)  G  7Z,  for  all  x ,  y  and  z  in  W;  it  is  reflexive  if  (x,  x)  G  7Z  for  all  x  G  W;  it  is  serial  if  for 
all  x  G  IV  there  is  a  y  such  that  (x,  y)  G  R;  and  it  is  transitive  if  (x,  y),  (y,  z)  G  7Z  implies  that 
(x,  z)  G  7Z.  for  x,  y  and  z  in  W.  Let  Adf£  be  the  set  of  Kripke  structures  with  Euclidean  and 
transitive  accessibility  relations,  be  the  subset  of  M.efl  where  the  accessibility  relations 
are  also  serial,  and  be  the  subset  of  where  the  accessibility  relations  are  also 

transitive. 

Theorem  1  [HM92]  The  axiom,  system  K  ( resp .  KJh5,  KDf5,  S5)  is  a  sound  and  complete 
axiom, atization  of  CK  with  respect  to  M.K  (resp.  Adf£,  AAfl1 ,  Aiffl). 

In  this  paper,  we  use  the  multi-agent  systems  formalism  of  [FHMV95]  to  model  knowledge; 
this  means  that  knowledge  satisfies  the  axioms  of  S5.  (We  provide  some  motivation  for  this 
choice  below;  see  [FHMV95]  for  further  discussion.) 

This  implies  that  if  an  agent  knows  0,  then  <p  is  true  (K3)  and  that  the  agent  is  introspective — 
he  knows  what  he  knows  and  does  not  know  (K4  and  K5).  Belief,  on  the  other  hand,  is 
typically  viewed  as  defeasible.  Thus,  it  does  not  necessarily  satisfy  K3.  It  may  satisfy  a  weaker 
property,  such  as  K6,  which  says  that  the  agent  does  not  believe  inconsistent  formulas.  Like 
knowledge,  belief  is  taken  to  be  introspective,  as  it  satisfies  K4  and  K5.  Thus,  in  the  literature, 
belief  has  typically  been  take  to  satisfy  K45  or  KD45;  we  do  the  same  here.  According  to 
Theorem  1,  this  means  that  the  notion  of  knowledge  we  use  is  characterized  by  while 
belief  is  characterized  by  JvYfl  or  Ad^L  2 


2.2  Plausibility  Measures 


Most  non-probabilistic  approaches  to  belief  change  require  (explicitly  or  implicitly)  that 
the  agent  has  some  ordering  over  possible  alternatives.  For  example,  the  agent  might  have  a 
preference  ordering  over  possible  worlds  [Bou94b,Gro88,KM91b]  or  an  entrenchment  ordering 

2  As  is  well  known,  a  relation  is  reflexive,  Euclidean  and  transitive  if  and  only  if  it  is  an  equivalence 
relation  (i.e.,  reflexive,  symmetric  and  transitive).  Thus,  consists  of  these  structures  where 

the  K-i  s  are  equivalence  relations. 
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over  formulas  [GM88].  This  ordering  dictates  how  the  agent’s  beliefs  change.  For  example,  in 
[Gro88],  the  new  beliefs  are  characterized  by  the  most  preferred  worlds  that  are  consistent 
with  the  new  observation,  while  in  [GM88]  beliefs  are  discarded  according  to  their  degree  of 
entrenchment  until  it  is  consistent  to  add  the  new  observation  to  the  resulting  set  of  beliefs. 

Keeping  this  insight  in  mind,  we  now  describe  plausibility  measures  [FH95,FH97b].  This  is 
a  notion  for  handling  uncertainty  that  generalizes  previous  approaches,  including  various 
notions  of  preference  ordering.  We  briefly  review  the  relevant  definitions  and  results  here. 

Recall  that  a  probability  space  is  a  tuple  (IT,  T,  Pr),  where  IT  is  a  set  of  worlds,  T  is 
an  algebra  of  measurable  subsets  of  IT  (that  is,  a  set  of  subsets  closed  under  union  and 
complementation  to  which  we  assign  probability),  and  Pr  is  a  probability  measure,  that  is,  a 
function  mapping  each  set  in  T  to  a  number  in  [0, 1]  satisfying  the  well-known  probability 
axioms  (Pr(0)  =  0,  Pr(lT)  =  1,  and  Pr(A  U  B)  =  Pr(A)  +  Pr(£>),  if  A  and  B  are  disjoint). 

A  plausibility  space  is  a  direct  generalization  of  a  probability  space.  We  simply  replace  the 
probability  measure  Pr  by  a  plausibility  measure  PI,  which,  rather  than  mapping  sets  in  T 
to  numbers  in  [0,1],  maps  them  to  elements  in  some  arbitrary  partially  ordered  set.  We  read 
P1(A)  as  “the  plausibility  of  set  A”.  If  P1(A)  <  Pl(£>),  then  B  is  at  least  as  plausible  as  A. 
Formally,  a  plausibility  space  is  a  tuple  S  —  (IT,  T,  PI),  where  IT  is  a  set  of  worlds,  T  is 
an  algebra  of  subsets  of  IT,  and  PI  maps  sets  in  T  to  some  domain  D  of  plausibility  values 
partially  ordered  by  a  relation  <D  (so  that  <d  is  reflexive,  transitive,  and  anti-symmetric). 
We  assume  that  D  is  pointed:  that  is,  it  contains  two  special  elements  T D  and  AD  such  that 
J -d<d  d  <d  T D  for  all  d  E  19;  we  further  assume  that  P1(1T)  =  T D  and  P1(0)  =1^.  As 
usual,  we  define  the  ordering  <D  by  taking  d\  <d  d2  if  d\  <£>  d2  and  d±  ^  d2.  We  omit  the 
subscript  D  from  <D,  <D,  TD  and  AD  whenever  it  is  clear  from  context. 

Since  we  want  a  set  to  be  at  least  as  plausible  as  any  of  its  subsets,  we  require 

A1  If  A  C  B,  then  P1(A)  <  PI (B). 

Some  brief  remarks  on  this  definition:  We  have  deliberately  suppressed  the  domain  D  of 
plausibility  values  from  the  tuple  S,  since  for  the  purposes  of  this  paper,  only  the  ordering 
induced  by  <  on  the  subsets  in  T  is  relevant.  The  algebra  T  also  does  not  play  a  significant 
role  in  this  paper.  Unless  we  say  otherwise,  we  assume  T  contains  all  subsets  of  interest  and 
suppress  mention  of  T ,  denoting  a  plausibility  space  as  a  pair  (IT,  PI). 

Clearly  plausibility  spaces  generalize  probability  spaces.  We  now  briefly  discuss  a  few  other 
notions  of  uncertainty  that  they  generalize: 

•  A  belief  function  B  on  IT  is  a  function  B  :  2W  — >  [0, 1]  satisfying  certain  axioms  [Sha76]. 
These  axioms  certainly  imply  property  Al,  so  a  belief  function  is  a  plausibility  measure. 

•  A  fuzzy  measure  (or  a  Sugeno  measure )  /  on  IT  [WK92]  is  a  function  /  :  2 11  i— >•  [0,1], 
that  satisfies  Al  and  some  continuity  constraints.  A  possibility  measure  [DP90]  Poss  is  a 
fuzzy  measure  such  that  Poss(lT)  =  1,  Poss(0)  =  0,  and  Poss(A)  =  sup,u,6j4(Poss({w;}). 

•  An  ordinal  ranking  (or  n-ranking )  on  IT  (as  defined  by  [GP92],  based  on  ideas  that  go 
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back  to  [Spo88])  is  a  function  k  :  2W  — >  IV*,  where  IV*  =  IVU  {oo},  such  that  k(W)  =  0, 
k(0)  =  oo,  and  k(A)  =  mmweA(n({w})) .  Intuitively,  an  ordinal  ranking  assigns  a  degree 
of  surprise  to  each  subset  of  worlds  in  W,  where  0  means  unsurprising  and  higher  numbers 
denote  greater  surprise.  It  is  easy  to  see  that  if  k  is  a  ranking  on  W,  then  (IT,  k)  is  a 
plausibility  space,  where  x  <^y*  y  if  and  only  if  y  <  x  under  the  usual  ordering  on  the 
ordinals. 

•  A  preference  ordering  on  W  is  a  partial  order  A  over  W  [KLM90,Sho87] .  Intuitively,  w  A  w' 
holds  if  w  is  preferred  to  w' .  Preference  orders  have  been  used  to  provide  semantics  for 
default  (i.e.,  conditional)  statements.  In  [FH97b]  we  show  how  to  map  preference  orders 
on  W  to  plausibility  measures  on  W  in  a  way  that  preserves  the  ordering  of  events  of  the 
form  {w}  as  well  as  the  truth  values  of  defaults.  We  review  these  results  below. 

•  A  parametrized  probability  distribution  (PPD)  on  W  is  a  sequence  {Pr,  :  i  >  0}  of 
probability  measures  over  W.  Such  structures  provide  semantics  for  defaults  in  e-semantics 
[Pea89,GMP93].  In  [FH97b]  we  show  how  to  map  PPDs  into  plausibility  structures  in  a 
way  that  preserves  the  truth- values  of  conditionals  (again,  see  discussion  below). 


2.3  The  Logic  of  Conditionals 


Our  goal  is  to  describe  the  agent’s  beliefs  in  terms  of  plausibility.  To  do  this,  we  describe 
how  to  evaluate  statements  of  the  form  B<f>  given  a  plausibility  space.  In  fact,  we  examine 
a  richer  logical  language  that  also  allows  us  to  describe  how  the  agent  compares  different 
alternatives.  This  is  the  logic  of  conditionals.  Conditionals  are  statements  of  the  form  (f>  — *  ip, 
read  “given  </>,  'if  is  plausible”  or  “given  <f,  then  by  default  if” .  The  syntax  of  the  logic  of 
conditionals  is  simple:  we  start  with  primitive  propositions  and  close  off  under  conjunction, 
negation  and  the  modal  operator  — The  resulting  language  is  denoted  Cc . 

Many  semantics  have  been  proposed  in  the  literature  for  conditionals.  Most  of  them  involve 
structures  of  the  form  (W,  X,  7r),  where  IT  is  a  set  of  possible  worlds,  tt(w)  is  a  truth  as¬ 
signment  to  primitive  propositions,  and  X  is  some  “measure”  on  IT  such  as  a  preference 
ordering,  a  ^-ranking,  or  a  possibility  measure.  We  now  describe  some  of  the  proposals  in 
the  literature,  and  then  show  how  they  can  be  viewed  as  using  plausibility  measures.  Given 
a  structure  (IT.  A',  tt).  let  [0]  C  IT  be  the  set  of  worlds  satisfying  &. 

•  A  possibility  structure  is  a  tuple  (IT,  Poss,  7r),  where  Poss  is  a  possibility  measure  on  IT. 
It  satisfies  a  conditional  <f>  — >  if  if  either  Poss(|]o])  =  0  or  Poss(|0  A  if])  >  Poss([0  A  -A^?]) 
[DP91] .  That  is,  either  <f  is  impossible,  in  which  case  the  conditional  holds  vacuously,  or 
(f  A  if  is  more  possible  than  &  A  -t if  . 

•  A  K-structure  is  a  tuple  (W, «,  7r),  where  k  is  an  ordinal  ranking  on  IT.  It  satisfies  a 
conditional  (f  — >•  if  if  either  «([</>])  =  oo  or  k([©  A  ?//])  <  k([</>  A  -i^])  [GP92], 

•  A  preferential  structure  is  a  tuple  (IT,  A,  7r),  where  A  is  a  partial  order  on  IT.  The  intuition 
[Sho87]  is  that  a  preferential  structure  satisfies  a  conditional  <j>  —>■  if  if  all  the  most  preferred 
worlds  (i.e.,  the  minimal  worlds  according  to  A)  in  [0]  satisfy  if.  However,  there  may  be 
no  minimal  worlds  in  |</>].  This  can  happen  if  [0]  contains  an  infinite  descending  sequence 


. . .  -<  w2  -<  w\.  What  do  we  do  in  these  structures?  There  are  a  number  of  options:  the  first 
is  to  assume  that,  for  each  formula  <p.  there  are  minimal  worlds  in  [0] ;  this  is  the  assumption 
actually  made  in  [KLM90],  where  it  is  called  the  smoothness  assumption.  A  yet  more 
general  definition — one  that  works  even  if  -<  is  not  smooth — is  given  in  [Lew73,Bou94a]. 
Roughly  speaking,  <p  — >  ip  is  true  if,  from  a  certain  point  on,  whenever  <p  is  true,  so  is  ip. 
More  formally, 

( W. ,  ,  7r)  satisfies  0  — >  -0,  if  for  every  world  w\  G  [0],  there  is  a  world  w2  such  that  (a) 

w2  A  Wi  (so  that  w2  is  at  least  as  normal  as  w i),  (b)  w2  G  [<^At/i],  and  (c)  for  all  worlds 
w3  P  w2,  we  have  w3  G  \<p  =>  ip]  (so  any  world  more  normal  than  w2  that  satisfies  <p 
also  satisfies  ip). 

It  is  easy  to  verify  that  this  definition  is  equivalent  to  the  earlier  one  if  -<  is  smooth. 

•  A  PPD  structure  is  a  tuple  ( W. ,  {Pr,  :  i  >  0} ,  7r) ,  where  {Pr,}  is  PPD  over  W.  Intuitively, 
it  satisfies  a  conditional  <p  ip  if  the  conditional  probability  ip  given  <p  goes  to  1  in  the 
limit.  Formally,  0  —  v  is  satisfied  if  limi^-p0Pri(|^]||^!)  =  1  [GMP93]  (where  Prj{Jt/&J|[<£]) 
is  taken  to  be  1  if  Pr,  ([</>])  =  0). 

In  [FH97b]  we  use  plausibility  to  provide  semantics  for  conditionals  and  show  that  our 
definition  generalizes  the  definition  in  the  various  approaches  we  just  described.  We  briefly 
review  the  definitions  and  results  here. 

A  plausibility  structure  is  a  tuple  PL  =  (IT,P1,7t),  where  PI  is  a  plausibility  measure  on  IT. 
Conditionals  are  evaluated  according  to  a  rule  that  is  essentially  that  used  in  possibility 
structures: 

•  PL  \=  <p  ip  if  either  Pl(f</>])  =_L  or  Pl(  0  A  ip])  >  Pl([</>  A  -up]). 

Intuitively,  <p  ip  holds  vacuously  if  <p  is  impossible;  otherwise,  it  holds  if  <p  A  ip  is  more 
plausible  than  <p>  A  ~np.  It  is  easy  to  see  that  this  semantics  for  conditionals  generalizes 
the  semantics  of  conditionals  in  possibility  structures  and  K-structures.  The  following  result- 
shows  that  it  also  generalizes  the  semantics  of  conditionals  in  preferential  structures  and 
PPD  structures. 

Proposition  2  [FH97b] 

(a)  If  -<  is  a  preference  ordering  on  W,  then  there  is  a  plausibility  measure  Pl^  on  W  such 

that  (IT,  -C,  7r)  \=  —*  ip  if  and  only  if  (IT,  Pl^,  n)  |=  <p  — *  ip. 

(b)  If  PP  =  {Pr.,;}  is  a  PPD  on  W,  then  there  is  a  plausibility  measure  Plpp  such  that 
(IT,  {Pr*},  71-)  |=  <p  -*  ip  if  and  only  if  (IT,  P1pp,  n)  |=  <p  ->  ip. 

We  briefly  describe  the  construction  of  Pl^  and  Plpp  here,  since  we  use  them  in  the  sequel. 
Given  a  preference  order  -<  on  IT,  let  D0  be  the  domain  of  plausibility  values  consisting  of 
one  element  dw  for  every  element  w  G  IT.  We  define  a  partial  order  on  D0  using  dv  <  dw 
if  w  -<  v.  (Recall  that  w  -<  w'  denotes  that  w  is  preferred  to  w' .)  We  then  take  D  to  be 
the  smallest  set  containing  D0  that  is  closed  under  least  upper  bounds  (so  that  every  set  of 
elements  in  D  has  a  least  upper  bound  in  D ).  For  a  subset  A  of  IT,  we  can  then  define  Pl^(A) 
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to  be  the  least  upper  bound  of  {dw  :  w  G  A}.  Since  D  is  closed  under  least  upper  bounds, 
PE;  (A)  is  well  defined.  As  shown  in  [FH97b],  this  choice  of  PE  satisfies  Proposition  2. 

The  construction  in  the  case  of  PPD’s  is  even  more  straightforward.  Given  a  PPD  PP  = 
{Pr,t}  on  IV.  we  define  Plpp  as  follows: 

P1pp(A)  <  PI pp(B)  if  and  only  if  lim,^^  Pr,(5|A  U  B)  =  1. 

A  straightforward  argument  shows  that  this  choice  of  Plpp  satisfies  Proposition  2. 

These  results  show  that  our  semantics  for  conditionals  in  plausibility  structures  generalizes 
the  various  approaches  examined  in  the  literature.  Does  it  capture  our  intuitions  about 
conditionals?  In  the  AI  literature,  there  has  been  discussion  of  the  right  properties  of  default 
statements  (which  are  essentially  conditionals).  While  there  has  been  little  consensus  on 
what  the  “right”  properties  for  defaults  should  be,  there  has  been  some  consensus  on  a 
reasonable  “core”  of  inference  rules  for  default  reasoning.  This  core,  known  as  the  KLM 
properties  [KLM90],  consists  of  the  following  axiom  and  rules  of  inference: 

LLE.  From  <p  <p'  and  <p  — >  ip  infer  <//  — >  ip  (left  logical  equivalence) 

RW.  From  ip  =>-  ip'  and  (p  — >  ip  infer  <p  — >  ip'  (right  weakening) 

REF.  </>—*</>  (reflexivity) 

AND.  From  <f)  —>  ip i  and  <p  — » ip2  infer  <p.  — >  ip±  A  ip2 
OR.  From  (pi  — >  ip  and  <p2  —■ >  ip  infer  <piV  <p2  — >  ip 

CM.  From  <p  — ■>  ipi  and  <p  — >  ip2  infer  <p  f\  ipi  ip2  (cautious  monotonicity) 

LLE  states  that  the  syntactic  form  of  the  antecedent  is  irrelevant.  Thus,  if  <p\  and  (p2  are 
equivalent,  we  can  deduce  <p2  — >  ip  from  <pi  — >  ip.  RW  describes  a  similar  property  of  the 
consequent:  If  ip  (logically)  entails  ip' ,  then  we  can  deduce  (p  — >  ip'  from  <p  ip.  This  allows  us 
to  can  combine  default  and  logical  reasoning.  REF  states  that  < p  is  always  a  default  conclusion 
of  <p.  AND  states  that  we  can  combine  two  default  conclusions:  If  we  can  conclude  by  default 
both  ipi  and  ip2  from  (p ,  we  can  also  conclude  ipi  A  ip2  from  <p .  OR  states  that  we  are  allowed 
to  reason  by  cases:  If  the  same  default  conclusion  follows  from  each  of  two  antecedents,  then 
it  also  follows  from  their  disjunction.  CM  states  that  if  ipi  and  ip2  are  two  default  conclusions 
of  <p,  then  discovering  that  ipi  holds  when  (p  holds  (as  would  be  expected,  given  the  default) 
should  not  cause  us  to  retract  the  default  conclusion  ip2. 

Do  conditionals  in  plausibility  structures  satisfy  the  KLM  properties?  In  general,  the  answer 
is  no.  It  is  almost  immediate  from  the  definition  that  a  probability  measure  Pr  is  also  a 
plausibility  measure.  Notice  that  Pr(  oA;/.!J)  >  Pr([0A-i^>])  if  and  only  if  Pr(f$]  |  [0])  >  1/2. 
Expanding  the  semantics  of  conditionals,  we  get  that  (p  — >  ip  holds  in  Pr  exactly  if  Pr  ([<£])  =  0 
or  Pr(['i/i]  |  |0])  >  1/2.  It  is  easy  to  see  that  this  definition  does  not  satisfy  the  AND  rule: 
it  is  not  in  general  the  case  that  (p  — >  ipi  and  <p  — >  ip2  together  imply  cp  — >  (ipi  A  ip2),  since 
Pr(A!  |  B)  >  1/2  and  Pr(A2  |  B)  >  1/2  do  not  imply  Pr(A!  n  A2\B)  >  1/2.  Since  the  AND 
rule  is  a  fundamental  feature  of  qualitative  reasoning,  we  would  like  to  restrict  to  plausibility 
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structures  where  it  holds.  In  [FH97b]  we  show  that  the  following  condition  is  necessary  and 
sufficient  to  guarantee  that  the  And  rule  holds: 


A2  If  A,  B ,  and  C  are  pairwise  disjoint  sets,  Pl(AuB)  >  P1(C),  and  Pl(AuC)  >  P1(R), 
then  P1(A)  >  Pl(B  U  C). 

It  turns  out  that  conditionals  in  plausibility  structures  that  satisfy  A2  also  satisfy  LLE, 
RW,  and  CM.  They  also  satisfy  OR  when  one  of  the  conditionals  <pi  — >  up  and  (f>2  — >  Ip  is 
satished  non- vacuously  (that  is,  in  a  plausibility  measure  PI  such  that  either  Pl([0i])  >  -L 
or  Pl([(/)21)  >  -L).  To  satisfy  OR  in  general  we  need  another  condition: 

A3  If  P1(A)  =  Pl(£>)  =T,  then  P1(A  U  B )  =  L. 

A3  also  has  a  nice  axiomatic  characterization.  Let  N<f>  be  an  abbreviation  for  -i <p  — ■>  false. 
(This  operator  is  called  the  “outer  modality”  in  [Lew73].)  Expanding  the  definition  of  — >, 
we  get  that  N<f>  holds  at  w  if  and  only  if  Pl([-i0])  =_L.  Thus,  N<p  holds  if  —>'<p  is  considered 
completely  implausible.  We  can  think  of  the  N  modality  as  the  plausibilistic  version  of 
necessity.  It  is  easy  to  show  that  A3  corresponds  to  an  AND  rule  for  N.  It  holds  exactly  if 
(:Vo  A  :YL)  =>  N(<p  A  ip). 

A  plausibility  space  (W,  PI)  is  qualitative  if  it  satisfies  A2  and  A3.  A  plausibility  structure 
(IT,  PI,  7 r)  is  qualitative  if  (W,  PI)  is  a  qualitative  plausibility  space.  In  [FH97b]  we  show  that, 
in  a  very  general  sense,  qualitative  plausibility  structures  capture  default  reasoning.  More 
precisely,  we  show  that  the  KLM  properties  are  sound  with  respect  to  a  class  of  plausibility 
structures  if  and  only  if  the  class  consists  of  qualitative  plausibility  structures.  We  also  show 
that  a  very  weak  condition  is  necessary  and  sufficient  in  order  for  the  KLM  properties  to  be 
complete  axiomatization  of  the  language  of  default  entailment  considered  in  [KLM90] .  These 
results  help  explain  why  so  many  different  approaches  to  giving  semantics  to  conditionals 
are  characterized  by  the  KLM  properties.  In  addition,  as  we  shall  see,  it  also  shows  that  if 
we  want  belief  to  have  some  reasonable  properties,  then  we  need  to  restrict  to  qualitative 
plausibility  measures. 


2.4  Combining  Kriowled.ge  and  Plausibility 


We  now  define  a  logic  that  combines  knowledge  and  plausibility.  Let  CKC  be  the  language 
obtained  by  starting  with  primitive  propositions,  and  closing  off  under  conjunction,  negation, 
and  the  operators  K.t  and  — q  ,  i  =  1, . . . ,  n.  Note  that  we  have  a  different  conditional  operator 
for  each  agent.  We  read  (p  — q  if  as  “according  to  agent  7s  plausibility  measure,  <p  typically 
implies  tp" . 

A  (Kripke)  structure  (for  knowledge  and  plausibility)  is  a  tuple  ( W. ,  n,  JCi, . . . ,  /Cn,  Pi, ... ,  Pn) 
where  W,  1 r  and  JCi  are  just  as  in  Kripke  structures  for  knowledge,  while  Pt  is  a  plausibility 
assignment,  a  function  that  assigns  a  plausibility  space  to  agent  i  at  each  world.  Intuitively, 
the  structure  Pjfw )  =  (W^p,  Pl(«v;))  captures  agent  7s  plausibility  measure  in  the  world  w. 
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For  now  we  allow  W to  be  an  arbitrary  subset  of  W.  We  discuss  some  possible  restrictions 
on  W(w^  below.  It  is  reasonable  to  ask  at  this  point  where  the  plausibility  spaces  Vi(w)  are 
coming  from,  and  why  we  need  a  different  one  for  each  agent  at  each  world.  The  answer  to 
this  question  depends  very  much  on  the  intended  application.  We  defer  further  discussion  of 
this  issue  until  later. 

We  can  now  give  semantics  to  formulas  in  CKC  in  Kripke  structures  for  knowledge  and 
plausibility.  This  is  done  in  a  recursive  way  using  the  rules  specified  above  for  CK  and  Cc . 
Statements  of  the  form  K,t<p  are  evaluated  according  to  /C(: 

•  (M,  w)  |=  Ki4>  if  (M,  w')  \=  (j)  for  all  w1  G  JCi(w). 

Statements  of  the  form  <p  — q  ip  are  evaluated  according  to  Vt.  Let  [0] („,,«)  =  { w '  G  : 

( M,w ')  |=  <j>}. 

•  ( M,w )  1=  <p  -q  ip  if  either  lT^Vy,,:,;})  =±  or  Pl(W4)(t<M#J(«M))  >  1  >l(„,,i)( “oA 

We  now  define  beliefs.  Recall  that  true  — q  <p  means  that  p  is  more  plausible  than  -up 
according  to  agent’s  i  plausibility  measure.  We  might  say  that  in  this  case  the  agent  believes 
<p.  However,  recall  that  the  agent  can  have  different  plausibility  assessments  at  different 
worlds.  Thus,  there  can  be  a  model  M,  and  worlds  w,  w'  such  that  (w,  w')  G  K.i:  but  ( M ,  w)  |= 
true  — q  <p  while  ( M ,  w')  |=  -(true  — q  <p).  (In  Example  5,  we  show  why  this  extra  expressive 
power  is  necessary.)  That  is,  (p  is  more  plausible  than  -i <p  in  one  of  the  worlds  the  agent 
considers  possible,  but  not  in  another.  Since  our  intention  is  that  the  agent  should  not 
distinguish  between  accessible  worlds,  we  would  like  the  agent  to  have  the  same  beliefs  in  all 
the  worlds  he  considers  possible.  We  say  that  an  agent  believes  <p  if  he  knows  that  <p  is  more 
plausible  than  -up  in  all  the  worlds  he  considers  possible.  Thus,  we  define  Bi<p,  read  “agent 
i  believes  <£>' .  as  an  abbreviation  for  K,t ( true  — q  <p ). 


2.5  Example:  Circuit  Diagnosis 


The  following  example  illustrates  some  of  the  expressive  power  of  this  language.  Although 
it  only  involves  one  agent  and  only  one  plausibility  measure  in  any  given  structure,  it  can 
easily  be  extended  to  allow  for  many  agents  with  different  plausibility  measures. 

The  circuit  diagnosis  problem  has  been  well  studied  in  the  literature  (see  [DH88]  for  an 
overview).  Consider  a  circuit  that  contains  n  logical  components  cy, ... .  cn  and  k  lines 
h, . . .  ,lk ■  As  a  concrete  example,  consider  the  circuit  of  Figure  l.3  The  diagnosis  task  is 
to  identify  which  components  are  faulty.  The  agent  can  set  the  values  of  input  lines  of  the 
circuit  and  observe  the  output  values.  The  agent  then  compares  the  actual  output  values  to 
the  expected  output  values  and  attempts  to  locate  faulty  components. 

3  The  “full  adder”  example  is  often  used  in  the  diagnosis  literature.  In  our  discussion  here  we 
loosely  follow  the  examples  of  Reiter  [Rei87]. 
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Fig.  1.  A  full  adder.  X\  and  X2  are  XOR  gates,  A±  and  .4 2  are  AND  gates,  and  0\  is  an  OR  gate. 

We  model  this  situation  using  the  tools  we  presented  in  the  previous  sections.  We  start  by 
describing  the  agent’s  knowledge  using  a  Kripke  structure.  We  then  construct  two  possi¬ 
ble  plausibility  measures  over  worlds  in  this  Kripke  structures,  and  examine  the  resulting 
knowledge  and  belief. 


Knowledge  We  model  the  agent’s  knowledge  about  the  circuit  using  the  Kripke  struc¬ 
ture  Mfiag  =  (Wdiag,^diag,^diag)-  Each  possible  world  w  E  W diag  E  composed  of  two  parts: 
fault(w),  the  failure  set — that  is,  the  set  of  faulty  components  in  w,  and  value(w),  the  value 
of  all  the  lines  in  the  circuit.  We  consider  only  worlds  where  the  components  that  are  not  in 
the  failure  sets  perform  as  expected.  For  example,  in  the  circuit  of  Figure  1,  if  the  AND  gate 
Ai  is  not  faulty,  then  we  require  that  l5  has  value  “high”  if  and  only  if  both  li  and  l2  have 
the  value  “high”.  Most  accounts  of  diagnosis  assume  that  there  is  a  logical  theory  A  that 
describes  the  properties  of  the  device.  To  capture  our  intuition,  it  must  be  the  case  that  w 
is  a  possible  world  in  M  if  and  only  if  faultfw )  and  value(w )  are  together  consistent  with  A. 

The  most  straightforward  language  for  reasoning  about  faults  is  the  following:  let  §diag  = 
{faulty(ci) , . . .  ,faulty(cn ),  . . . ,  hi(lk)}  be  the  set  of  propositions,  where  each  faulty{cf) 

denotes  that  component  i  is  faulty  and  hi(li)  denotes  that  line  i  in  a  “high”  state.  We  then 
define  the  interpretation  tv diag  in  the  obvious  way:  tv diagi'w) (faulty (q))  =  true  if  c,t  E  faultfw ), 
and  tv diag(w)(hi(li))  =  true  if  (li:  1)  G  value{w). 

Next,  we  need  to  define  the  agent’s  knowledge.  We  define  ow  C  value(w )  to  be  the  values  of 
those  lines  the  agent  sets  or  observes.  The  agent  knows  which  tests  he  has  performed  and 
the  results  he  observed.  Therefore,  we  have  (w,w')  E  K.diag  if  ow  =  ow'.  For  example,  suppose 
the  agent  observes  hi{l\)  A  hi{f2)  A  hi(l3)  A  hi(lr)  A  hi(ls).  The  agent  then  considers  possible  all 
worlds  where  the  same  observations  hold.  Since  these  observations  are  consistent  with  the 
correct  behavior  of  the  circuit,  one  of  these  worlds  has  an  empty  failure  set.  However,  other 
worlds  are  possible.  For  example,  it  might  be  that  the  AND  gate  A2  is  faulty.  This  would 
not  affect  the  outputs  in  this  case,  since  if  Ax  is  non-faulty,  then  its  output  is  “high” ,  and 
thus,  Oi’s  output  is  “high”  regardless  of  A2  s  output. 
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Now  suppose  that  the  agent  observes  hi{l\)  A  -i hi(l2)  A  hi(l3)  A  hi(l7)  A  -i hi(l$).  These  observa¬ 
tions  imply  that  the  circuit  is  faulty.  (If  l\  and  l3  are  “high”  and  l2  is  “low” ,  then  the  correct- 
values  for  I-  and  1$  should  be  “low”  and  “high”,  respectively.)  In  this  case  there  are  several 
possible  failure  sets,  including  {Xi},  {X2,Oi},  and  {X2,A2}. 

In  general,  there  is  more  than  one  explanation  for  the  observed  faulty  behavior.  Thus,  the 
agent  can  not  know  exactly  which  components  are  faulty,  but  he  may  have  beliefs  on  that 
score. 


Plausibility  To  model  the  agent’s  beliefs,  we  need  to  decide  on  the  plausibility  measure 
the  agent  has  at  any  world.  We  assume  that  only  failure  sets  are  relevant  for  determining 
a  world’s  plausibility.  Thus,  we  start  by  constructing  a  plausibility  measure  over  possible 
failures  of  the  circuit.  We  assume  that  failures  of  individual  components  are  independent  of 
one  another.  If  we  also  assume  that  the  likelihood  of  each  component  failing  is  the  same,  we 
can  construct  a  preference  ordering  on  failure  set  as  follows:  If  f±  and  f2  are  two  failure  sets, 
we  say  that  fi  is  preferred  to  f2  if  |/i|  <  \f2\,  that  is,  if  f\  consists  of  fewer  faulty  components 
than  f2.  This  preference  ordering  induces  a  plausibility  measure  using  the  construction  of 
Proposition  2.  In  this  measure  Pl(iq)  <  P1(U2)  if  min/eFl(|/|)  <  min/eF2(|/|). 

We  can  construct  the  same  plausibility  measure  based  on  probabilistic  arguments  using 
PPDs.  Suppose  that  the  probability  of  a  single  component  failing  is  e.  Since  we  have  assumed 
that  failures  are  independent,  it  follows  that  the  probability  of  a  failure  set  /  is  e)hH/l), 

since  there  are  |/|  components  that  fail,  and  n— 1/|  components  that  do  not  fail.  To  model  the 
behavior  of  small  but  unknown  failure  probability,  we  can  consider  the  PPD  (Pr0,Pi’i, . . .), 
where  in  Prm  the  probability  of  a  single  failure  is  l/(m  +  1).  It  is  not  hard  to  check  that 
linp™  Prm(F2)/Prra(Fi)  =  0  if  and  only  if  Pl(-F2)  <  Pl(iq)  in  the  plausibility  measure 
described  above.  Interestingly,  this  plausibility  measure  is  almost  identical  to  the  ^-ranking 
in  which  k({/})  =  |/|.  The  only  difference  is  that  if  |/i|  =  \f2\,  Pl({/i})  is  incomparable  to 
Pl({/2})  in  the  plausibility  measure  we  constructed,  while  they  are  equal  according  to  the 
K-ranking. 

In  some  situations  it  might  be  unreasonable  to  assume  that  all  components  have  equal  failure 
probability.  Thus,  we  might  assume  that  for  each  component  ct  there  is  a  probability  e,  of 
failure.  If  we  assume  independence,  then  given  e  =  (elr . . . ,  e„),  the  probability  of  a  failure 
set  /  is  nCie/e,:nci0/(l  —  e?:).  We  can  construct  a  PPD  that  captures  the  effect  of  the  efs 
getting  smaller,  but  at  possibly  different  rates:  Suppose  g  is  a  bijection  from  JNm  to  IN. 
If  m  =  (mi,...,m„),  let  Prg(^)  be  the  distribution  where  the  probability  of  ct  failing  is 
1  /(mj  +  1),  for  i  =  1, . .  .,n.  In  this  case,  we  get  that  lim™^,*, Prm(/2)/ Prm(/i)  =  0  if  and 
only  if  f2  is  a  strict  subset  of  /i,  i.e. ,  if  / 1  contains  all  the  components  in  f2  and  more.  Since 
we  do  not  assume  any  relations  among  the  failure  probabilities  of  different  components,  it 
is  not  possible  to  compare  failure  sets  unless  one  is  a  subset  of  the  other.  Thus,  we  can 
define  /  A  f  if  /  C  /'.  Using  the  construction  of  Proposition  2,  we  can  again  consider  the 
plausibility  measure  PI  induced  by  A.  It  is  not  hard  to  see  that  Pl(Fi)  <  P1(T2)  if  for  every 
failure  set  f\  E  —  F2  there  is  some  /2  G  F2  such  that  f2  A  f\.  As  our  construction  shows, 
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this  plausibility  measure  can  be  induced  by  either  a  preference  ordering  or  a  PPD;  however, 
it  cannot  be  captured  by  a  K-ranking  or  a  possibility  measure,  since  the  ordering  on  failure 
sets  is  partial. 


Beliefs  We  now  have  the  required  components  to  examine  the  agent’s  beliefs.  Using  the 
two  plausibility  measures  we  just  described,  we  can  construct  two  possible  structures  Mdwg.i 
and  Mdwg2 .  In  both  structures  we  set  W(w> ij  =  /C*09(iu),  and  in  both  Addmg,i  and  Mdiag,2  the 
plausibility  measure  is  induced  from  a  preference  ordering  on  failures  (using  the  construction 
of  Proposition  2).  In  Mdiag,  1,  we  take  the  plausibility  measure  to  be  such  that  Pl(w,,i)({^})  > 
Pipe,!) (W})  and  °aly  if  \fault(w)\  <  \fault(w')\ ,  and  in  Mdmg<2  so  that  Pl(^,i)({w})  > 
Pl(w>,i) ({^’,})  if  and  only  if  faidtiw )  C  fault(w').  It  is  easy  to  see  that,  in  both  structures, 
if  there  is  a  world  w  in  which  these  observations  occur  and  where  faultfw )  =  0,  then  the 
agent  believes  that  the  circuit  is  faultless.  If  the  agent  detects  an  error,  he  believes  that 
it  is  caused  by  one  of  the  minimal  explanations  of  his  observations,  where  the  notion  of 
minimality  differs  in  the  two  structures.  We  now  make  this  statement  more  precise.  Let 
/  be  a  failure  set.  Let  Df  be  the  formula  that  denotes  that  /  is  the  failure  set,  so  that 
( M,w )  |=  Df  if  and  only  if  fault{w)  =  f.  The  agent  believes  that  /  is  a  possible  diagnosis 
(i.e.,  an  explanation  of  his  observations)  if  -iB^Df.  The  set  of  diagnoses  the  agent  considers 
possible  is  Bel (M,w)  =  {/  :  ( M,w )  j=  We  say  that  a  failure  set  /  is  consistent 

with  an  observation  o  if  it  is  possible  to  observe  o  when  /  occurs,  i.e.,  if  there  is  a  world  w 
in  W  such  that  fault(w )  =  /  and  ow  =  o. 4 

Proposition  3  (a)  Bel(Addmg,uw)  contains  all  failure  sets  f  that  are  consistent  with  ow 
such  that  there  is  no  failure  set  f  with  \f  \  <  \  f\  which  is  consistent  with  ow. 

(b)  Bel(Mdiag,2iw)  contains  all  failure  sets  f  that  are  consistent  with  ow  such  that  there  is 
no  failure  set  f  with  f  C  f  which  is  consistent  with  ow . 


PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  both  Be\(Mdiag,i,w)  and  Bel {AAdiag,2i  w)  consist  of  minimal  sets  of  failure  sets  consistent 
with  ow,  for  different  notions  of  minimality.  In  the  case  of  A/t(lmgj .  “minimality”  means 
“of  minimal  cardinality”,  while  in  the  case  of  Mdiag, a,  it  means  “minimal  in  terms  of  set 
containment” .  This  proposition  shows  that  Md/Uig.i  and  Mdtag,2  capture  standard  assumptions 
made  in  model-based  diagnosis;  Addiag,i  captures  the  assumptions  made  in  [de  90],  while 
Mdiag,2  captures  the  assumptions  made  in  [Rei87].  More  concretely,  in  our  example,  if  the 
agent  observes  hi{fi)  A -> hi(l2)  A  hi(l3)  A  hi(lr)  A  ~^hi(ls),  then  in  Mdiag,i  she  would  believe  that 
Xi  is  faulty,  since  {W}  is  the  only  diagnosis  with  cardinality  one.  On  the  other  hand,  in 
Mdiag, 2  she  would  believe  that  one  of  the  three  minimal  diagnoses  occurred:  {W},  {X2,  O i} 
°r  {X2 ,  A2 } . 

4  Note  that  if  A  is  a  theory  that  describes  the  properties  of  circuit,  then  a  failure  /  is  consistent 
with  observation  o,  if  and  only  if  /  and  o  are  consistent  according  to  A. 
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2. 6  Properties  of  Knowledge  and  Plausibility 


Kripke  structures  for  knowledge  and  plausibility  are  quite  similar  to  the  Kripke  structures  for 
knowledge  and  probability  introduced  by  Fagin  and  Halpern  [FH94a].  The  only  difference 
is  that  in  Kripke  structures  for  knowledge  and  probability,  Vi(w)  is  a  probability  space 
rather  than  a  plausibility  space.  Fagin  and  Halpern  explore  various  natural  restrictions  on 
the  interactions  between  the  probability  spaces  Vjfw)  and  the  accessibility  relations  AQ. 
Here  we  investigate  restrictions  on  the  interaction  between  the  plausibility  spaces  and  the 
accessibility  relations.  Not  surprisingly,  some  of  these  conditions  are  exact  analogues  to 
conditions  investigated  by  Fagin  and  Halpern. 

Given  our  interest  in  the  KLM  properties,  we  will  be  interested  in  structures  that  satisfy  the 
following  condition: 

QUAL  Vi(w )  is  qualitative  for  all  worlds  w  and  agents  i. 

The  same  arguments  that  show  that  A2  gives  us  the  AND  rule  also  show  that  it  gives  us 
property  K2  for  beliefs.  More  precisely,  we  have  the  following  result. 

Theorem  4  If  M  satisfies  QUAL ,  then  for  all  worlds  w  in  M,  we  have 

(a)  (M,  w)  |=  ((a  <p)  A  (a  -q  if))  =>  (a  (</>  A  if)) 

(b)  (M,  w)  |=  UjO  A  Biif  =>  lf(o  A  if) 

(c)  (M,  w)  \=  Bi(f  A  Bjfcf  A  if)  =>  Biif. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


In  view  of  this  result,  we  typically  assume  that  QUAL  holds  whenever  we  want  to  reason 
about  belief. 

The  set  H  („;j)  consists  of  all  worlds  to  which  agent  i  assigns  some  degree  of  plausibility  in 
world  w.  We  would  not  expect  the  agent  to  place  a  positive  probability  on  worlds  that  he 
considers  impossible.  Similarly,  he  would  not  want  to  consider  as  plausible  (even  remotely) 
a  world  he  knows  to  be  impossible.  This  intuition  leads  us  to  the  following  condition,  called 
CONS  for  consistency  (following  [FH94a]): 

CONS  W(Wji)  C  fC  fw)  for  all  worlds  w  and  all  agents  i.  5 

5  We  remark  that  CONS  is  inappropriate  if  we  use  — >  to  model,  not  plausibility,  but  counterfactual 
conditions,  as  is  done  by  Lewis  [Lew73].  If  CONS  holds,  then  it  is  easy  to  see  that  K-wp  =>  Kj(-«f>  — q 
if)  is  valid,  for  all  if.  That  is,  if  agent  i  knows  </>,  then  he  knows  that  in  the  most  plausible  worlds 
where  -up  is  true,  if  is  vacuously  true,  because  there  are  no  plausible  worlds  where  ^cp  is  true.  On 
the  other  hand,  under  the  counterfactual  reading,  it  makes  perfect  sense  to  say  “I  know  the  match 
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A  consequence  of  assuming  CONS  is  a  stronger  connection  between  knowledge  and  belief. 
Since  CONS  implies  that  the  most  plausible  worlds  are  in  ICflw),  it  follows  that  if  the  agent 
knows  <p  he  also  believes  q b.  (Indeed,  as  we  shall  see,  this  condition  characterizes  CONS.) 

In  probability  theory,  the  agent  assigns  probability  1  to  the  set  of  all  worlds.  Since  1  >  0,  this 
means  the  agent  assigns  non-zero  probability  to  some  sets  of  worlds.  It  is  possible  to  have 
T  =  _L  in  plausibility  spaces.  If  this  happens,  the  agent  considers  all  sets  to  be  completely 
implausible.  The  following  condition,  called  NORM  for  normality  (following  [Lew73]),  says 
this  does  not  happen: 

NORM  V(w,i )  is  normal,  that  is,  for  all  worlds  w  and  all  agents  i. 

We  can  strengthen  this  condition  somewhat  to  one  that  says  that  the  agent  never  considers 
the  real  world  implausible.  This  suggests  the  following  condition:  Pl(„Vi)  ({'«.’})  >_L.  Stating 
this  condition,  however,  leads  to  a  technical  problem.  Recall  that  Pl(W)p  is  defined  over  the 
set  of  measurable  subsets  of  W(w^.  In  general,  however,  singletons  may  not  be  measurable. 
Thus,  we  examine  a  slightly  weaker  condition  which  we  call  REF  for  reflexive  (following 
[Lew73]): 

REF  For  all  worlds  w  and  all  agents  i, 

•  we  H  and 

•  Pl(U,jj)(A)  >T  for  all  A  e  P(w.i)  such  that  w  e  A. 

As  we  said  in  the  introduction,  much  of  the  previous  work  using  conditionals  assumed  (im¬ 
plicitly  or  explicitly)  that  the  agent  considers  only  one  plausibility  measure  possible.  This 
amounts  to  assuming  that  the  plausibility  measure  is  a  function  of  the  agent’s  epistemic 
state.  This  is  captured  by  an  assumption  called  SDP  (following  [FH94a])  for  state  deter¬ 
mined  plausibilities : 

SDP  For  all  worlds  w  and  w'  and  all  agents  i.  if  (w,w')  e  fCt  then  Vflw)  —  Vflw'). 

It  is  easy  to  see  that  SDP  implies  that  an  agent  knows  his  plausibility  measure.  In  particular, 
as  we  shall  see,  with  SDP  we  have  that  <j)  — q  ip  implies  Kficp  — q  ip). 

It  is  easy  to  verify  that  the  structures  described  in  the  diagnosis  example  of  Section  2.5 
satisfy  CONS,  REF,  and  SDP.  As  mentioned  in  the  introduction,  SDP  is  not  appropriate  in 
all  situations;  at  times  we  may  want  to  allow  the  agent  to  consider  possible  several  plausibility 
measures.  To  capture  this,  we  need  to  generalize  SDP.  The  following  example  might  help 
motivate  the  formal  definition. 

Example  5  This  is  a  variation  of  the  Liar's  Paradox.  On  a  small  Pacific  island  there  are 
two  tribes,  the  Rightfeet  and  the  Leftfeet.  The  Rightfeet  are  known  to  usually  tell  the  truth, 
while  the  Leftfeet  are  known  to  usually  lie.  Alice  is  a  visitor  to  the  island.  She  encounters  a 
native,  Bob,  and  discusses  with  him  various  aspects  of  life  on  the  island.  Now,  Alice  does  not 

is  dry,  but  it  is  not  the  case  that  if  it  were  wet,  then  it  would  light  if  it  were  struck.'’ 
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know  to  what  tribe  Bob  belongs.  Thus,  she  considers  it  possible  both  that  Bob  is  a  Rightfoot 
and  that  he  is  a  Leftfoot.  In  the  first  case,  she  should  believe  what  he  tells  her  and  in  the 
second  she  should  be  skeptical. 

One  possible  way  of  capturing  this  situation  is  by  partitioning  the  worlds  Alice  considers 
possible  into  two  sets,  according  to  Bob's  tribe.  Let  W u  (resp.  Wl)  be  the  set  of  worlds 
that  Alice  considers  possible  where  Bob  is  a  Rightfoot  (resp.  Leftfoot).  As  the  discussion 
above  suggests,  Alice ’s  plausibility  measure  at  the  worlds  of  Wr  gives  greater  plausibility 
to  worlds  where  Bob  is  telling  the  truth  than  to  worlds  where  Bob  is  lying;  the  opposite 
situation  holds  at  worlds  of  Wl-  In  such  a  structure,  the  formula  l\  Alice  (t.ell(o)  — > Aim 
-ifi)  A  —iKAiice-'(tell((f))  Alice  <f>)  is  satisfiuble,  where  tellfifi)  is  the  formula  that  holds  when 
Bob  tells  Alice  <f>.  On  the  other  hand,  in  structures  satisfying  SDP,  this  formula  is  satisfiable 
only  when  tellifif)  has  plausibility  _L  in  all  the  worlds  that  Alice  considers  possible. 

While  this  example  may  seem  contrived,  in  many  situations  it  is  possible  to  extract  param¬ 
eters  such  as  Leftfoot  and  Rightfoot  that  determine  which  conditional  statements  are  true. 
For  example,  when  we  introduce  time  into  the  picture  (in  Section  3.1),  these  parameters 
might  be  the  agent’s  own  actions  in  the  future.  Such  a  partition  allows  us  to  make  state¬ 
ments  such  as  “I  do  not  know  whether  0  is  plausible  or  not,  but  I  know  that  if  I  do  a,  then 
<p  is  plausible” ,  where  is  some  statement  about  the  future.  If  the  agent  does  not  know  the 
value  of  these  parameters,  she  will  not  necessarily  know  which  conditionals  are  true  at  a 
given  world  (as  was  the  case  in  the  example  above). 

Example  5  motivates  the  condition  called  uniformity. 

UNIF  For  all  worlds  w  and  agents  i ,  if  w'  G  W(VKi)  then  V,  (w )  =  V,  {wr) .  6 

It  is  not  hard  to  show  that  UNIF  holds  if  and  only  if,  for  each  agent  i,  we  can  partition 
the  set  of  possible  worlds  in  such  a  way  that  for  each  cell  C  in  the  partition,  there  is  a 
plausibility  space  (Wc,  Pic)  such  that  Wc  V  C  and  Tfiw)  =  (Wc,  Pic)  for  all  worlds  w  G  C . 
Moreover,  if  CONS  also  holds,  then  this  partition  refines  the  partition  induced  by  the  agent’s 
knowledge,  i.e. ,  if  C  is  a  cell  in  the  partition  and  w  is  some  world  C,  then  C  C  JCfiw).  It 
easily  follows  that  SDP  and  CONS  together  imply  UNIF. 

When  we  model  uncertainty  about  the  relative  plausibility  of  different  worlds  this  way  it 
is  reasonable  to  demand  that  the  plausibility  measure  totally  orders  all  events;  i.e.,  it  is  a 
ranking.  The  RANK  assumption  is: 

RANK  For  all  worlds  w  and  agents  i,  Vfiw)  is  a  ranking,  that  is,  for  all  sets  A,  B  C  Ww 
either  P1W(A)  <  Plw(£>)  or  Plw(£>)  <  P1W(A),  and  Plu,(Au  B )  =  max(Plu,(A),  P1W(R)). 

Note  that  K-rankings  and  possibility  measures  are  two  examples  of  rankings.  Additionally, 
rational  preference  orderings  of  [KLM90]  are  essentially  rankings  in  the  sense  that  for  each 

0  This  condition  is  not  the  same  as  uniformity  as  defined  in  [Lew73];  rather,  it  corresponds  in  the 
Lewis  terminology  to  absoluteness. 


18 


rational  preference  ordering  we  can  construct  a  ranking  that  satisfies  exactly  the  same  con¬ 
ditional  statements  [Fri97,FH97b]. 

While  rankings  are  quite  natural,  they  have  often  been  rejected  as  being  too  inexpressive 
[Gin86].  In  a  ranking  there  is  a  total  order  on  events.  The  standard  argument  for  partial  orders 
is  as  follows:  In  general,  an  agent  may  not  be  able  to  determine  the  relative  plausibility  of  a 
and  b.  If  the  plausibility  measure  is  a  ranking,  the  agent  is  forced  to  make  this  determination; 
with  a  partial  order,  he  is  not.  This  argument  loses  much  of  its  force  in  our  framework,  once 
we  combine  knowledge  and  plausibility.  As  we  said  above,  the  agent’s  ignorance  can  be 
modeled  by  allowing  him  to  consider  (at  least)  two  rankings  possible,  one  in  which  a  is  more 
plausible  than  b,  and  one  in  which  b  is  more  plausible  that  a.  The  agent  then  believes  neither 
that  a  is  more  plausible  than  b  nor  that  b  is  more  plausible  than  a. 


2. 7  Knowledge  and  Belief 


How  reasonable  is  the  notion  of  belief  we  have  defined?  In  this  section,  we  compare  it  to 
other  notions  considered  in  the  literature. 

Recall  that  CB  be  the  language  where  the  only  modal  operators  are  £>i, . . . ,  Bn.  Let  CKB  be 
the  language  where  we  have  K1: ,  Kn  and  £>i, . . . ,  Bn  (but  no  — q  operators).  It  is  not  hard 
to  see  (and  will  follow  from  our  proofs  below)  that  to  get  belief  to  satisfy  even  minimal  such 
as  K2,  we  need  the  AND  rule  to  hold.  Thus,  in  this  section,  we  restrict  attention  to  Kripke 
structures  for  knowledge  and  plausibility  that  satisfy  QUAL.  We  then  want  to  investigate 
the  impact  of  adding  additional  assumptions.  Let  Jv[  be  the  set  of  all  Kripke  structures  for 
knowledge  and  plausibility  that  satisfy  QUAL,  and  let  A1C0NS  (resp.  W1C0NS,N0RM)  be  the 
structures  satisfying  QUAL  and  CONS  (resp.  QUAL,  CONS  and  NORM). 

Work  on  belief  and  knowledge  in  the  literature  [HM92,Hin62,Lev84]  has  focused  on  the  modal 
systems  S5,  KD45,  K45,  and  K  with  semantics  based  on  Kripke  structures  as  described 
in  Section  2.1.  Before  we  examine  the  properties  of  belief  in  our  approach,  we  relate  our 
semantics  of  belief  (in  terms  of  plausibility)  to  the  more  standard  Kripke  approach,  which 
presumes  that  belief  is  defined  in  terms  of  a  binary  relation  Can  we  define  a  relation  B, 
in  terms  of  AQ  and  Vt  such  that  ( M,w )  |=  £>.,;(/>  if  and  only  if  (M,v)  |=  for  all  v  E  £>.,(«;)? 
We  show  that  this  is  possible  in  some  structures,  but  not  in  general. 

Let  S  =  (IT,  PI)  be  a  qualitative  plausibility  space.  We  say  that  A  C  W  is  a  set  of  most 
plausible  worlds  if  P1(A)  >  P1(A)  (where  A  is  the  complement  of  A,  i.e.,  W  —  A)  and  for 
all  B  C  A,  Pl(£>)  Pl(£>).  That  is,  A  is  a  minimal  set  of  worlds  that  is  more  plausible 

than  its  complement.  It  is  easy  to  verify  that  if  such  a  set  exists,  then  it  must  be  unique. 
To  see  this,  suppose  that  A  and  A'  are  both  sets  of  most  plausible  worlds.  We  now  show 
that  P1(A  fl  A1)  >  PI  (yl  fi  A').  Since  A  and  A!  are  both  most  plausible  sets  of  worlds,  this 
will  show  that  we  must  have  A  =  A'.  To  see  that  P1(A  n  A')  >  Pl(Afi  A'),  first  note 
that  A  n  A' ,  A  —  A'  and  A  are  pairwise  disjoint.  Since  A  and  A'  are  most  plausible  sets 
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of  worlds,  we  have  that  P1((H  fl  A!)  U  (A  —  A'))  =  P1(H)  >  P1(H)  and  Pl((^4  fl  A')  U  A)  > 
P1((H  n  A')  U  (A!  -  A))  =  P1L4')  >  P1L47)  >  P1M  -  A').  We  can  apply  A2  to  get  that 
PI  (A  n  A1)  >  P1((H  -  A')  U  A)  =  Pl(HnW). 

In  finite  plausibility  structures  (that  is,  ones  with  only  finitely  many  worlds),  it  is  easy  to  see 
that  there  is  always  a  (unique)  set  of  most  plausible  worlds.  In  general,  however,  a  set  of  most 
plausible  worlds  does  not  necessarily  exist.  For  example,  consider  the  space  So  =  (IT,  PI), 
where  W  =  {wt  :  i  >  0}  and  PI  is  defined  as  follows:  P1(H)  =  oo  if  A  contains  an  infinite 
number  of  worlds,  and  P1(H)  =  maxMje^(z)  otherwise.  Suppose  that  P1(H)  >  P1(H).  A  must- 
be  finite,  for  otherwise  P1(H)  =  oo.  Thus,  A  must  be  infinite.  Suppose  Wi  G  A.  It  is  easy 
to  see  that  A  —  {m,}  is  infinite  and  A  —  { w,/: }  is  finite.  Thus,  P1(H  —  {m,})  >  P1(H  —  {m,;}). 
This  shows  that  there  does  not  exist  a  set  of  most  plausible  worlds  in  S. 

If  there  is  no  set  of  most  plausible  worlds,  then  we  may  not  be  able  to  find  a  relation  B, 
that  characterizes  agent  As  beliefs.  For  example,  consider  the  structure  M  =  (IT,  n,  /Ci,  Vi), 
where  IT  =  {wt  :  i  >  0}  is  the  set  of  worlds  described  in  So  above;  7r  assigns  truth  values 
to  primitive  propositions  pi,P2, ...  in  such  a  way  that  n(wi)(pj)  =  true  if  and  only  if  j  >  *5 
/Ci  is  the  complete  accessibility  relation  /Ci  =  IT  x  IT:  and  V\  (wf)  is  the  space  S0  described 
above.  It  is  not  hard  to  verify  that  (M,w0)  |=  Bi4>  if  and  only  if  [_iC)](«i0,j)  is  a  finite  set, 
i.e. ,  there  is  an  index  i  such  that  for  all  j  >  i,  we  have  ( M,Wj )  f=  <f).  Thus,  (M,w0)  |=  Bipj 
for  all  j  >  0.  Yet  there  are  no  worlds  in  the  model  that  satisfy  all  the  propositions  pj  at 
once.  Thus,  there  is  no  accessibility  relation  B\  that  characterizes  agent  l’s  beliefs  in  w0. 

On  the  other  hand,  we  can  show  that  if  there  is  always  a  set  of  most  plausible  worlds,  then 
we  can  characterize  the  agents’  beliefs  by  an  accessibility  relation.  Let  S  =  (IT,  PI)  be  a 
plausibility  space.  Define  MP(S')  to  be  the  set  of  most  plausible  worlds  in  S  if  it  exists,  and 
0  if  PI  (IT)  =  _L.  Otherwise  MP(S')  is  not  defined. 

Proposition  6  Let  M  be  a  Kripke  structure  for  knowledge  and  plausibility.  If  MP(Vi{w')) 
is  defined  for  all  w'  G  JCjfw),  then  ( M,w )  |=  B i<f>  if  and  only  if  ( M,w ")  \=  <f  for  all  w"  G 
U  w'eKi{w)MP(Vi{w')). 


PROOF.  Straightforward:  left  to  the  reader.  □ 


This  proposition  implies  that,  if  most  plausible  sets  of  worlds  always  exist  in  M,  then  we  can 
set  Bjfw)  =  {fPi{w'))  and  recover  the  usual  Kripke- style  semantics  for  belief. 

This  discussion  shows  that  our  model  of  belief  is  more  general  than  the  classical  Kripke- 
st  met  lire  account  of  beliefs,  since  there  are  models  where  the  agent’s  beliefs  are  not  de¬ 
termined  by  a  set  of  accessible  worlds.  However,  as  we  shall  see,  this  does  not  lead  to  new 
properties  of  beliefs  in  CB .  Roughly  speaking,  this  is  because  we  have  a  finite  model  property: 
a  formula  in  CB  is  satisfiable  if  and  only  if  it  is  satisfiable  in  a  finite  model  (see  Theorem  13 
below).  It  is  easy  to  verify  that  in  a  finite  model  MP (V-fw))  is  always  defined.  We  note, 
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however,  that  this  finite  model  property  is  no  longer  true  when  we  consider  the  interaction 
of  beliefs  with  other  modalities,  such  as  time,  or  when  we  examine  the  first-order  case.  In 
these  situations,  the  two  models  of  beliefs  are  not  equivalent.  Plausibility  is  strictly  more 
expressive;  see  [FHK96]. 

We  now  examine  the  formal  properties  of  belief  and  knowledge  in  structures  of  knowledge 
and  plausibility.  We  start  by  restricting  our  attention  to  CB .  As  we  show  below,  the  modal 
system  K  precisely  characterizes  the  valid  formulas  of  CB  in  the  class  Ai.  However,  in  the 
literature,  belief  has  typically  been  taken  to  be  characterized  by  the  modal  system  K45  or 
KD45,  not  K.  We  get  K45  by  restricting  to  models  that  satisfy  CONS,  and  KD45  by  further 
restricting  to  models  that  satisfy  NORM.  Thus,  the  two  requirements  that  are  most  natural, 
at  least  if  we  have  a  probabilistic  intuition  for  plausibility,  are  already  enough  to  make  Bj  a 
KD45  operator. 

Theorem  7  K  (resp.,  Kf5,  KDf5)  is  a  sound  and  complete  axiomatization  for  CB  with 
respect  to  Ai  (resp.,  A4C0NS,  AdC0NS,N0RMJ. 


PROOF.  See  Appendix  A.l.  □ 


We  now  consider  knowledge  and  belief  together.  This  combination  has  been  investigated  in 
the  literature  [KL88,Voo92],  In  particular,  Kraus  and  Lehmann  [KL88]  define  Kripke  struc¬ 
tures  for  knowledge  and  belief  that  have  two  accessibility  relations,  one  characterizing  the 
worlds  that  are  knowledge- accessible  and  one  characterizing  worlds  that  are  belief-accessible. 
Kj  and  Bj  are  defined,  as  usual,  in  terms  of  these  relations.  They  argue  that  the  two  acces¬ 
sibility  relations  must  be  coherent  in  the  sense  that  the  agent  knows  what  she  believes  and 
believes  what  she  knows  to  be  true.  Kraus  and  Lehmann  describe  restrictions  on  the  inter¬ 
action  between  the  two  relations  that  force  this  coherence.  They  show  that  in  the  resulting 
structures,  the  interactions  between  knowledge  and  belief  are  characterized  by  the  following 
axioms. 

KB1.  Bj(j)  =>  KtBtcj) 

KB 2.  Kj cj)  =>-  Bjf) 

It  turns  out  that  KB1  holds  in  Ai  and  KB2  is  a  consequence  of  CONS.  To  see  this,  recall 
that  Bpp  =  Kjftrue  — ■> <f>).  Using  positive  introspection  for  knowledge  (axiom  K4),  we  derive 
that  BjCft  =>-  KjKjftrue  —?  </>).  This  is  equivalent  to  axiom  KB1.  When  M  satisfies  CONS,  we 
have  that  l L(„.q)  C  JCj(w).  If  ( M,w )  |=  iyU,  then  all  worlds  in  JCjfw)  satisfy  <f>.  This  implies 
that  there  are  no  worlds  satisfying  -t tf>  in  and  thus  B,t<p  must  hold.  Thus,  KB2  must- 

hold. 

We  now  state  this  formally.  Let  AXKB  consist  of  the  S5  axioms  for  the  operators  Kt.  the  K 
axioms  for  the  operators  Bj,  together  with  KB1;  let  AXKB,C0NS  consist  of  AXKB  together 
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with  the  K4  and  K5  axioms  for  Bt  and  KB2;  and  let  AXKB’C0NS’N0RM  consist  of  AXKB’C0NS 
together  with  the  K6  axiom  for  Bt. 

Theorem  8  AXKB  (resp.,  TXKB,C0NS,  AA'KB,C0NS’N0RMy)  is  a  sound  and  complete  axioma- 
tization  of  CKB  with  respect  to  M  (resp.,  A4C0NS,  A4C0NS,N0RMy). 


PROOF.  See  Appendix  A.l.  □ 


As  an  immediate  corollary,  we  get  that  there  is  a  close  relationship  between  our  framework 
and  that  of  [KL88].  Let  I\L  be  the  logic  of  Kraus  and  Lehmann: 

Corollary  9  For  any  <j>  G  CKB ,  KL  |=  <p  if  and  only  if  A4C0NS’N0RM  [=  </>. 

We  now  relate  to  three  other  notions  of  beliefs  in  the  literature — those  of  Moses  and  Shoham 
[MS93],  Voorbraak  [Voo92],  and  Lamarre  and  Shoham  [LS94], 

Moses  and  Shoham  [MS93]  also  view  belief  as  being  derived  from  knowledge.  The  intuition 
that  they  try  to  capture  is  that  once  the  agent  makes  a  defeasible  assumption,  the  rest  of 
his  beliefs  should  follow  from  his  knowledge.  In  this  sense,  Moses  and  Shoham  can  be  viewed 
as  focusing  on  the  implications  of  an  assumption  and  not  on  how  it  was  obtained.  We  can 
understand  their  notion  as  saying  that  <f  is  believed  if  it  is  known  to  be  true  in  the  most 
plausible  worlds.  But  for  them,  plausibility  is  not  defined  by  an  ordering.  Rather,  it  is  defined 
in  terms  of  a  formula,  which  can  be  thought  of  as  characterizing  the  most  plausible  worlds. 
More  formally,  for  a  fixed  formula  a,  they  define  Bfcj  to  be  an  abbreviation  for  Kjfa  =>  <f>).  7 
The  following  result  relates  our  notion  of  belief  to  that  of  Moses  and  Shoham. 

Lemma  10  Let  M  be  a  propositional  Kripke  structure  of  knowledge  and  plausibility  satis¬ 
fying  CONS  and  SDP.  Suppose  that  w,  i,  and  a  are  such  that  the  most  plausible  worlds  in 
Vifw )  are  exactly  those  worlds  in  JCfw)  that  satisfy  a,  i.e.,  MP(fPi(w ))  =  {w'  G  ICjfw )  : 

1=  a}.  Then  for  any  formula  (f>  G  CKB  that  includes  only  the  modalities  K,  and  B,. 
( M,w )  1 =  <f>  if  and  only  if  ( M,w )  |=  <f>* ,  where  <f>*  is  the  result  of  recursively  replacing  each 
subformula  of  the  form  Bpf  in  (j>  by  Kt(a  =>-  if*). 


PROOF.  See  Appendix  A.l.  □ 


Voorbraak  [Voo92]  distinguishes  two  notions  of  knowledge:  objective  knowledge  and  true 
justified  belief .  He  then  studies  the  interaction  of  both  notions  of  knowledge  with  beliefs.  The 
intuition  we  assign  to  knowledge  is  similar  to  Voorbraak’s  intuition  for  objective  knowledge. 

7  Shoham  and  Moses  also  examine  two  variants  of  this  definition.  These  mainly  deal  with  the 
cases  where  a  is  inconsistent  with  the  agent’s  knowledge.  For  simplicity,  we  assume  here  that  a  is 
consistent  with  the  agent’s  knowledge. 
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However,  Voorbraak  objects  to  the  axiom  700  =>-  Bt(p.  and  suggests  £>*0  =>  B,  K,o.  The 
difference  lies  in  the  interpretation  of  belief.  Voorbraak’s  notion  of  belief  is  stronger  than 
ours.  His  view  is  that  the  agent  cannot  distinguish  what  he  believes  from  what  he  knows 
(indeed,  he  believes  that  what  he  believes  is  the  same  as  what  he  knows).  Our  notion  of 
belief  is  weaker,  in  that  we  allow  agents  to  be  aware  of  the  defeasibility  of  their  beliefs. 

Lamarre  and  Shoham  [LS94]  investigate  the  notion  of  knowledge  as  justified  true  belief  using 
a  framework  that  is  very  similar  to  ours.  They  start  with  an  explicit  preference  ordering 
over  possible  worlds,  and  then  define  Ba<f>  to  read  “given  evidence  a,  0  holds  in  the  most- 
plausible  ct- worlds” .  Their  formal  account  of  Ba(f)  is  exactly  a  — >•,  <j)  in  our  notation.  Unlike 
us,  they  examine  a  notion  of  knowledge  as  “belief  stable  under  incorporation  of  correct 
facts”,  which  is  rather  different  then  our  notion  of  objective  knowledge.  Thus,  while  the 
technical  construction  is  similar,  the  resulting  framework  is  substantially  different.  Lamarre 
and  Shoham  take  plausibility  to  be  the  only  primitive,  and  use  it  to  determine  both  knowledge 
and  belief.  We  take  both  knowledge  and  plausibility  to  be  primitive,  and  use  them  to  define 
belief. 


2.8  Axiomcitizing  the  Language  of  Knowledge  and  Plausibility 

Up  to  now,  we  have  considered  just  the  restricted  language  CKB .  We  now  present  sound 
and  complete  axiomatizations  for  the  full  language  CKC .  The  technical  details  are  much  in 
the  spirit  of  the  axiomatizations  presented  in  [FH94a]  for  knowledge  and  probability.  Our 
complete  axiomatization  for  A4  consists  of  two  “modules” :  a  complete  axiomatization  for 
knowledge  (i.e.,  S5)  and  a  complete  axiomatization  for  conditionals.  In  the  general  case, 
there  are  no  axioms  connecting  knowledge  and  plausibility.  For  each  of  the  conditions  we 
consider,  we  provide  an  axiom  that  characterizes  it.  The  axioms  characterizing  NORM,  REF, 
RANK,  and  UNIF  are  taken  from  [Lew73]  and  [BurSl]  (see  also  [Fri97,FH97b]),  while  the 
axioms  for  CONS  and  SDP  (and  also  UNIF)  correspond  directly  to  the  axioms  suggested 
in  [FH94a]  for  their  probabilistic  counterparts.  We  also  provide  complete  characterizations 
of  the  complexity  of  the  validity  problem  for  all  the  logics  considered,  based  on  complexity 
results  for  knowledge  [HM92]  and  for  conditionals  [FH96a]. 

The  axiom  system  can  be  modularized  into  three  components:  propositional  reasoning,  rea¬ 
soning  about  knowledge,  and  reasoning  about  conditionals.  The  component  for  propositional 
reasoning  consists  of  K1  and  RK1  (from  Section  2.1);  the  component  for  reasoning  about 
knowledge  consists  of  K2-K5  and  RK2  (from  Section  2.1);  the  component  for  reasoning 
about  conditionals  consists  of  the  standard  axioms  and  rules  for  conditional  logic  C1-C4, 
RC1,  and  RC2  described  in  [Fri97,FH97b]  following  [BurSl, Lew73]: 


Cl.  0-> 

C2.  ((0- 
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Rl.  From  0  and  0  ip  infer  0 

RC1.  From  0  0'  infer  (0  — >  0)  =>•  (0'  — >  0) 

RC2.  From  0  =>-  0'  infer  (0  — »  0)  =>-  (0  — >  0') 

Let  AX  consist  of  K1-K5,  C1-C4,  RK1,  RK2,  RC1,  and  RC2. 

Theorem  11  AX  is  a  sound  and  complete  axiomatization  for  CKC  with  respect  to  Xi. 


PROOF.  See  Appendix  A. 2.  □ 


We  now  capture  the  conditions  described  above — CONS,  NORM,  REF,  SDP,  UNIF,  and 
RANK — axiomatically. 

RANK,  NORM,  REF,  and  UNIF  correspond  the  axioms  C5-C8,  respectively,  from  [Fri97,FH97b]: 

C5.  0  — *  0  A  -00  — »  -0)  =»  0  A  £  — »  0 
C6.  -i {true false) . 

C7.  A0->0 

C8.  [(0  — >  0)  A(0  — »  0)]  A  [— 1(0  — »•  0)  =>■  iV — i (0  — >  0)] 

CONS  and  SDP  correspond  to  the  following  axioms,  respectively; 

C9.  700  W0 

CIO.  (0  ->j  0)  =»  70(0  0) 

It  is  interesting  to  note  that  the  axioms  for  CONS  and  UNIF  are  derived  from  the  axioms 
defined  in  [FH94a]  by  replacing  w(<p)  =  1  (the  probability  of  0  is  1)  by  A(0,  which  has 
a  similar  reading.  We  show  that  adding  the  appropriate  axioms  to  AX  gives  a  sound  and 
complete  axiomatization  of  the  logic  with  respect  to  the  class  of  structures  satisfying  the 
corresponding  conditions. 

Theorem  12  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDP}  and  let  A 
be  the  corresponding  subset  of  {C5,  06,  07,  08,  09,  CIO}.  Then  AX  U  A  is  a  sound,  and 
complete  axiomatization  with  respect  to  the  structures  in  Xi  satisfying  A. 


PROOF.  See  Appendix  A. 2.  □ 


We  now  consider  the  complexity  of  the  validity  problem.  Our  results  are  based  on  a  combi¬ 
nation  of  results  for  complexity  of  epistemic  logics  [HM92]  and  conditional  logics  [FH96a]. 
Again,  the  technical  details  are  much  in  the  spirit  of  those  in  [FH94a]. 
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We  start  with  few  results  that  will  be  useful  in  our  discussion  of  complexity.  As  is  often  the 
case  in  modal  logics,  we  can  prove  a  “small  model  property”  for  our  logic:  if  a  formula  is 
satisfiable  at  all,  it  is  satisfiable  in  a  small  model.  Let  Sub(cf>)  be  the  set  of  subformulas  in  <fi. 
It  is  easy  to  see  that  an  upper  bound  on  |  Sub{4>)  |  is  the  number  of  symbols  in  <f>. 

Theorem  13  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}.  The  formula 
(p  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable  in  a  Kripke 
structure  with  at  m.ost  2!^^  I  worlds. 


PROOF.  See  Appendix  A. 2.  □ 


This  shows  that  if  <f  is  satisfiable,  then  it  is  satisfiable  in  a  model  with  at  most  exponential 
number  of  worlds.  Such  a  “small  model”  result  is  useful  when  we  consider  upper  bound  on 
the  complexity  of  checking  satisfiable.  Roughly  speaking,  if  there  is  a  small  model,  then  we 
can  construct  this  model  in  time,  say,  exponential  in  the  size  of  the  formula.  However,  there 
is  one  problem  with  the  result  we  have  just  proved.  This  “small”  number  of  worlds  does  not 
necessarily  mean  that  we  can  compactly  describe  the  Kripke  structure.  Recall  that  Plp^ 
describes  an  ordering  over  subsets  of  Thus,  in  the  worst  case,  we  need  to  describe 

an  ordering  on  2lW(”’i)l  sets  of  worlds.  Thus,  the  representation  of  a  structure  might  be 
exponential  in  the  number  of  worlds.  Fortunately,  we  can  show  that  a  satisfiable  formula  is 
satisfiable  in  a  small  model  with  a  compact  representation. 

We  start  with  a  definition.  We  say  that  M  =  ( W. ,  ir,  K\, . . . ,  K,n,  V\, ... ,  V„)  is  a  preferential 
(Kripke)  structure  if  for  each  Vjfw),  there  is  a  preference  ordering  on  W(VKl)  that 

induces  Pl^p  using  the  construction  of  Proposition  2.  Recall  that  a  preference  ordering  is  a 
binary  relation  on  the  set  of  possible  worlds.  Thus,  if  W  is  finite,  we  can  describe  the  relations 
K-i  and  the  preference  orderings  using  tables  of  size  at  most  |  TP” | 2 .  So  the  representation 
of  such  structures  is  polynomial  in  \W\.  Is  it  possible  to  find  a  small  preferential  Kripke 
structure  satisfying  (/>?  Indeed  we  can.  Using  results  of  [FH96a],  we  immediately  get  the 
following  lemma: 

Lemma  14  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}.  If  a  formula 
(()  is  satisfiable  in  a  Kripke  structure  satisfying  A  with  N  worlds,  then  is  satisfiable  in  a 
preferential  Kripke  structure  with  at  most  |Sub(</>)|A  worlds. 

Combining  this  with  Theorem  13,  we  conclude  that  if  <p  is  satisfiable,  then  it  is  satisfiable 
in  a  structure  of  exponential  size  with  an  exponential  description.  It  can  be  shown  that  this 
result  is  essentially  optimal  (see  [HM92,FH96a]).  However,  if  there  is  only  one  agent  and  we 
assume  CONS  and  either  UNIF  or  SDP,  then  we  can  get  polynomial-sized  models. 

Theorem  15  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}  containing 
CONS  and  either  SDP  or  UNIF.  If  <f>  talks  about  the  knowledge  and  plausibility  of  only  one 
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agent ,  then  <j)  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable 
in  a  preferential  Kripke  structure  satisfying  A  with  at  most  |Sub(0)|3  worlds. 


PROOF.  See  Appendix  A. 2.  □ 


We  now  consider  the  complexity  of  decision  procedure  for  the  validity  problem.  The  difficulty 
of  deciding  whether  <p  is  valid  is  a  function  of  the  length  of  <f,  written  \<f\. 

Theorem  16  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}.  If  CONS  e 
A,  but  it  is  not  the  case  that  UNIF  or  SDP  is  in  A,  then  the  validity  problem  with  respect 
to  structures  satisfying  A  is  complete  for  exponential  time.  Otherwise,  the  validity  problem 
is  complete  for  polynomial  space. 


PROOF.  See  Appendix  A. 2.  □ 


If  we  restrict  attention  to  the  case  of  one  agent  and  structures  satisfying  CONS  and  either 
UNIF  or  SDP,  then  we  can  do  better. 

Theorem  17  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}  containing 
CONS  and  either  UNIF  or  SDP.  For  the  case  of  one  agent,  the  validity  problem  in  models 
satisfying  A  is  co-NP- complete. 


PROOF.  See  Appendix  A. 2.  □ 


3  Adding  Time 


In  the  previous  section,  we  developed  a  model  of  knowledge  and  beliefs.  Having  a  good  model 
of  knowledge  and  belief  is  not  enough  in  order  to  study  how  beliefs  change.  Indeed,  if  we  are 
mainly  interested  in  agents’  beliefs,  the  additional  structure  of  plausibility  spaces  does  not 
play  a  significant  role  in  a  static  setting.  However,  if  we  introduce  an  explicit  notion  of  time, 
we  expect  the  plausibility  measure  to  (partially)  determine  how  agents  change  their  beliefs. 
As  we  shall  see,  this  gives  a  reasonable  notion  of  belief  change. 

In  this  section,  we  introduce  time  into  the  framework.  We  then  examine  how  time,  knowledge, 
and  plausibility  interact.  In  particular,  we  suggest  a  notion  of  conditioning  that  captures  the 
intuition  that  plausibility  changes  in  the  minimal  way  that  is  required  by  changes  to  the 
agent’s  knowledge. 
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3.1  Knowledge  and  Plausibility  in  Multi- Agent  Systems 


A  straightforward  approach  to  adding  time  is  by  introducing  another  accessibility  relation 
on  worlds,  which  characterizes  their  temporal  relationship  (see,  for  example,  [KL88]).  We 
introduce  more  structure  into  the  description  by  adopting  the  framework  of  Halpern  and 
Fagin  [HF89]  for  modeling  multi-agent  systems.  This  structure  gives  a  natural  definition  of 
knowledge  and  an  intuitive  way  to  describe  agents’  interactions  with  their  environment.  We 
start  by  describing  the  framework  of  Halpern  and  Fagin,  and  then  add  plausibility. 

The  key  assumption  in  this  framework  is  that  we  can  characterize  the  system  by  describing 
it  in  terms  of  a  state  that  changes  over  time.  This  is  a  powerful  and  natural  way  to  model 
systems.  Formally,  we  assume  that  at  each  point  in  time,  each  agent  is  in  some  local  state. 
Intuitively,  this  local  state  encodes  the  information  that  is  available  to  the  agent  at  that  time. 
In  addition,  there  is  an  environment ,  whose  state  encodes  relevant  aspects  of  the  system  that 
are  not  part  of  the  agents’  local  states.  For  example,  if  we  are  modeling  a  robot  that  navigates 
in  some  office  building,  we  might  encode  the  robot’s  sensor  input  as  part  of  the  robot’s  local 
state.  If  the  robot  is  uncertain  about  his  position,  we  would  encode  this  position  in  the 
environment  state. 

A  global  state  is  a  tuple  (se,  si, . . . ,  sn)  consisting  of  the  environment  state  se  and  the  local 
state  Sj  of  each  agent  i.  A  run  of  the  system  is  a  function  from  time  (which,  for  ease  of 
exposition,  we  assume  ranges  over  the  natural  numbers)  to  global  states.  Thus,  if  r  is  a 
run,  then  r(0),  r(l):, ...  is  a  sequence  of  global  states  that,  roughly  speaking,  is  a  complete 
description  of  what  happens  over  time  in  one  possible  execution  of  the  system.  We  take  a 
system  to  consist  of  a  set  of  runs.  Intuitively,  these  runs  describe  all  the  possible  sequences 
of  events  that  could  occur  in  a  system. 

Given  a  system  1Z,  we  refer  to  a  pair  (r,  m)  consisting  of  a  run  r  G  1Z  and  a  time  m  as  a  point. 

If  r{m )  =  (,se...  .S] . «s„).  we  define  r,;(m)  =  sp  thus,  r,;(m)  is  agent  i’s  local  state  at  the 

point  (r,  m).  Finally,  to  reason  in  a  logical  language  about  such  a  system,  we  need  to  assign 
truth  values  to  primitive  propositions.  An  interpreted  system  is  a  tuple  (7 Z,  n)  consisting  of  a 
system  1Z  together  with  a  mapping  n  that  associates  a  truth  assignment  with  the  primitive 
propositions  at  each  state  of  the  system. 

An  interpreted  plausibility  system  can  be  viewed  as  a  Kripke  structure  for  knowledge.  We 
say  two  points  (?’,  m)  and  (r',  m')  are  indistinguishable  to  agent  i,  and  write  (?’,  m)  (r',  m'), 
if  ?’,;(m)  =  r'(m'),  i.e.,  if  the  agent  has  the  same  local  state  at  both  points.  This  is  consistent 
with  the  intuition  that  an  agent’s  local  state  encodes  all  the  information  available  to  the 
agent.  Taking  to  define  the  /C(  relation,  we  get  a  Kripke  structure  over  points.  8 

This  definition  of  knowledge  has  proved  useful  in  many  applications  in  distributed  systems 
and  AI  (see  [FHMV95]  and  the  references  therein).  As  argued  above,  we  want  to  add  the 

8  It  is  straightforward  to  extend  these  definitions  to  deal  with  continuous  time.  This  is  done,  for 
example,  in  [BLMS97]. 
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notion  of  plausibility  so  that  we  can  model  the  agent’s  beliefs.  It  is  straightforward  to  do 
so  by  adding  a  plausibility  assessment  for  each  agent  at  each  point.  Formally,  an  interpreted 
plausibility  system  is  a  tuple  X  =  (1Z,  tv,  V\, . . . ,  Vn),  where  7 Z  and  tv  are  as  before,  and 
the  plausibility  assignment  Vi  maps  each  point  ( r,m )  to  a  plausibility  space  Vi(r,m )  = 

(  i) )  • 

In  order  to  reason  about  the  temporal  aspects  of  the  system,  we  add  to  the  language  temporal 
modalities  in  the  standard  fashion  (see  [GPSS80]).  These  include  O <fi  for  “</>  is  true  at  the 
next  time  step”  We  call  this  language  CKCT .  Evaluation  of  temporal  modalities  at  a  point 
(r,  m)  is  done  by  examining  the  future  points  on  the  run  r :  Given  a  point  (?’,  m )  in  an 
interpreted  system  X,  we  have  that 

•  {I,  r,  m )  |=  0<f)  if  ( X ,  r,  m  +  1)  (=</>.  9 

This  framework  is  clearly  a  temporal  extension  of  the  logic  of  knowledge  and  plausibility 
described  in  the  previous  section. 


3.2  Example:  Circuit  Diagnosis  Revisited 


We  now  show  how  the  framework  can  be  used  to  extend  the  example  of  Section  2.5  to 
incorporate  time,  allowing  the  agent  to  perform  a  sequence  of  tests. 

We  want  to  model  the  process  of  diagnosis.  That  is,  we  want  to  model  the  agent’s  beliefs  about 
the  circuit  while  it  performs  a  sequence  of  tests,  and  how  the  observations  at  each  step  affects 
her  beliefs.  Thus,  we  want  to  model  the  agent  and  the  circuit  as  part  of  a  system.  To  do  so,  we 
need  to  describe  the  agent’s  local  state  and  the  state  of  the  environment.  The  construction 
we  used  in  Section  2.5  provides  a  natural  division  between  the  two:  The  agent’s  state  is 
the  sequence  of  input-output  relations  observed,  while  the  environment’s  state  describes  the 
faulty  components  of  the  circuit  and  the  values  of  all  the  lines.  This  corresponds  to  our 
intuitions,  since  the  agent  can  observe  only  the  input-output  relations.  Each  run  describes 
the  results  of  a  specific  series  of  tests  the  agent  performs  and  the  results  he  observes.  We  make 
two  additional  assumptions:  (1)  the  agent  does  not  forget  what  tests  were  performed  and  their 
results,  and  (2)  the  faults  are  persistent  and  do  not  change  over  time.  Formally,  we  define  the 
agent’s  state  ?q(m)  to  be  (op.j0),  ■  •  •  ,  0(r,m)),  where  0(r:7n)  describes  the  input-output  relation 
observed  at  time  m.  We  define  the  environment  state  re(m )  =  ( fault(r ,  m),  value(r ,  m ))  to  be 
the  failure  set  at  (?’)  and  the  values  of  all  the  lines.  We  capture  the  assumption  that  faults  do 
not  change  by  requiring  that  fault{r,m)  =  fault(r,  0).  The  system  7 Zdmg  consists  of  all  runs 
r  satisfying  these  requirements  in  which  value{r,m )  is  consistent  with  faultier,  m)  and  o^r^m) 
for  all  m. 

Given  the  system  7 Zdiag,  we  can  define  two  interpreted  plausibility  systems  corresponding 

9  It  is  easy  to  add  other  temporal  modalities  such  as  until,  eventually,  since,  etc.  These  do  not 
play  a  role  in  this  work. 
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to  the  two  plausibility  measures  we  considered  in  Section  2.5.  In  both  systems,  q  = 

In  Xdiagy  1,  we  compare  two  points  (ri,m)  and  (r2,m)  by  comparing  the  size  of 
fault(ri,m )  and  fault(r2,  m),  while  in  Xdiag, 2  we  check  whether  one  failure  set  is  a  subset  of 
the  other.  At  a  point  ( r,m ),  the  agent  considers  possible  all  the  points  where  he  performed 
the  same  tests  up  to  time  m  and  observed  the  same  results.  As  before,  the  agent  believes  that 
the  failure  set  is  one  of  the  minimal  explanations  of  his  observations.  As  the  agent  performs 
more  tests,  his  knowledge  increases  and  his  beliefs  might  change. 

We  define  Bel (X,r,m)  to  be  the  set  of  failure  sets  (i.e...  diagnoses)  that  the  agent  considers 
possible  at  (r,  m).  Belief  change  in  Xdiag^  is  characterized  by  the  following  proposition. 

Proposition  18  If  there  is  some  f  G  Bel(Xdiagji,r,m)  that  is  consistent  with  the  new  ob¬ 
servation  0(riTO+1),  then  Bel(Xdiag:i ,  r,m  +  1)  consists  of  all  the  failure  sets  in  Bel{Xdiag^,  r,  m) 
that  are  consistent  with  o^m+  q.  If  all  f  G  B(Xdiag^,r,m)  are  inconsistent  with  0(r,m+  q,  then 
B (Xdiag,. 1,  r,  m  +  1)  consists  of  all  failure  sets  of  cardinality  j  that  are  consistent  with  op/m+i); 
where  j  is  the  least  cardinality  for  which  there  is  at  least  one  failure  set  consistent  with 

0(r,m.+ 1)  • 


PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  in  Xdiag 4,  a  new  observation  consistent  with  the  current  set  of  most  likely  explana¬ 
tions  reduces  this  set  (to  those  consistent  with  the  new  observation).  On  the  other  hand, 
a  surprising  observation  (one  inconsistent  with  the  current  set  of  most  likely  explanations) 
has  a  rather  drastic  effect.  It  easily  follows  from  Proposition  18  that  if  o^m+ q  is  surpris¬ 
ing,  then  Bel(Xdiag:i,r,m)  0  Bel(Xdiag:i,r,m  +  1)  =  0,  so  the  agent  discards  all  his  current 
explanations  in  this  case.  Moreover,  an  easy  induction  on  m  shows  that  if  Bel(2*;ag,i,  r,  m)  0 
Bel(Xdiagji,  r,  m  +  1)  =  0,  then  the  cardinality  of  the  failure  sets  in  B e\(Xdiagji,r,m  +  1)  is 
greater  than  the  cardinality  of  failure  sets  in  Bel(2*a9,i,  r,  m).  Thus,  in  this  case,  the  expla¬ 
nations  in  Bel(Xdiag:i,r,m  +  1)  are  more  complicated  than  those  in  B(Xdiag^,r,m).  Notice 
that  if  we  can  characterize  the  observation  Oq.jm+q  in  our  language- — that  is,  if  we  have  a 
formula  (f>  such  ( X ,  r',  ml)  |=  <f>  if  and  only  if  0 =  Oq.jm+ 1) — then  we  can  also  express  the 
fact  that  agent  i  considers  it  surprising:  This  is  true  precisely  if  (Xdiag>i,r:m)  f=  £>,- 1  Of>- 

Belief  change  in  Xdiag^  is  quite  different,  as  the  following  proposition  shows.  Given  a  failure 
set  /,  we  define  ext(f)  =  {/'  :  /  C  /'}.  Thus,  ext(f )  consists  of  all  the  failure  sets  that 
extend  /. 

Proposition  19  Bel{Xd,wg  2.  r.  m  +  1)  consists  of  the  minimal  (according  to  C)  failure  sets 
in  U feBel{id  rm.)ex^f^  ^hat  are  consistent  with  0(rjm+ q. 


PROOF.  Straightforward;  left  to  the  reader.  □ 
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We  see  that,  as  with  I  ding ,i>  failure  sets  that  are  consistent  with  the  new  observation  are 
retained.  However,  unlike  Tdiag^  failure  sets  that  are  discarded  are  replaced  by  more  com¬ 
plicated  failure  sets  even  if  some  of  the  explanations  considered  most  likely  at  (r,  m)  are 
consistent  with  the  new  observation.  Moreover,  while  new  failure  sets  in  Bel {Tdiag,i,r,m  +  1) 
can  be  unrelated  to  failure  sets  in  Bel  (2*^1,  r,  m),  in  Tdiag,i  the  new  failure  sets  must  be 
extensions  of  some  discarded  failure  sets.  Thus,  in  Tdmg,  1  the  agent  does  not  consider  new 
failure  sets  as  long  as  the  observation  is  not  surprising.  On  the  other  hand,  in  Xdiag,2  the 
agent  has  to  examine  new  candidates  after  each  test.  The  latter  behavior  is  essentially  that- 
described  by  Reiter  [Rei87,  Section  5]. 


3.3  Axiomatizing  the  Language  of  Knowledge,  Plausibility  and  Time 


We  now  present  sound  and  complete  axiomatization  for  the  language  CKCT .  The  technical 
details  are  much  in  the  spirit  of  the  results  of  Section  2.8,  with  two  exceptions.  First,  we 
need  to  deal  also  with  the  temporal  modality  Q.  Second,  instead  of  dealing  with  worlds, 
we  are  dealing  with  systems  that  have  some  structure,  i.e. ,  the  distinction  between  agents’ 
local  state  and  the  environment’s  state.  As  we  shall  see,  both  issues  can  be  dealt  with  in  a 
straightforward  manner. 

The  axiom  system  AXT  consists  of  the  axioms  and  rule  in  the  axiom  system  AX  of  Section  2.8 
and  the  following  axioms  and  rule  the  describe  the  properties  of  0:- 

Tl.  O0  A  0(0  =>-  0)  =>  O0 
T2.  O 0  =  _,O_,0 
RT1.  From  <f>  infer  O 0- 

Let  C  be  the  set  of  all  plausibility  interpreted  systems. 

Theorem  20  The  axiom  system  ANT  is  a  sound  and  complete  axiomatization  of  CKCT  with 
respect  to  C. 


PROOF.  See  Appendix  A. 3.  □ 


We  can  also  prove  a  result  analogous  to  Theorem  12  that  describes  a  complete  axiomatization 
for  the  classes  of  systems  satisfying  some  of  the  assumptions  we  examined  in  Section  2.4. 

Theorem  21  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDP}  and  let  A  be 
the  corresponding  subset  of  {05,  06,  Cl,  08,  09,  CIO}.  Then  ANT  U  A  is  a  sound  and 
complete  axiomatization  with  respect  to  systems  in  C  satisfying  A. 


PROOF.  See  Appendix  A. 3.  □ 
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4  Prior  Plausibilities 


The  formal  framework  of  knowledge,  plausibility  and  time  described  in  the  previous  section 
raises  a  serious  problem:  While  it  is  easy  to  see  where  the  relations  that  define  knowledge 
come  from,  the  same  cannot  be  said  for  the  plausibility  spaces  Vt  (r.  m).  We  now  present  one 
possible  answer  to  this  question,  inspired  by  probability  theory. 

Up  to  now,  we  have  allowed  the  plausibility  assessment  at  each  point  to  be  almost  arbitrary. 
In  particular,  the  plausibility  space  Vt (r,  m)  can  be  quite  different  from  Vi(r,m  +  1).  Typ¬ 
ically,  we  would  expect  there  to  be  some  relationship  between  these  successive  plausibility 
assessments.  For  example,  it  seems  reasonable  to  expect  that  the  new  plausibility  assessment 
should  incorporate  whatever  was  learned  at  (r,  m  +  1),  but  otherwise  involve  minimal  changes 
from  Vj  (r,  m ). 

One  way  of  doing  this  in  probability  theory  is  by  conditioning.  If  we  start  with  a  probability 
function  Pr  and  observe  E.  where  Pr (E)  >  0,  then  the  conditional  probability  function  Pr£ 
is  defined  so  that  Pie(A)  =  Pi(AnE)/ Pr(E).  Typically  Pi’£(A)  is  denoted  Pr(A\E).  Notice 
that  PiE  incorporates  the  new  information  E  by  giving  it  probability  1.  It  also  is  a  minimal 
change  from  Pr  in  the  sense  that  if  A,  B  C  E,  then  Pr(A)/ Pr(£>)  =  Pr(A|£,)/Pr(S|£l):  the 
relative  probability  of  events  consistent  with  E  is  not  changed  by  conditioning. 10 

Conditioning  is  a  standard  technique  in  probability  theory,  and  can  be  justified  in  a  number 
of  ways,  one  of  which  is  the  notion  of  “minimal  change”  we  have  just  described.  Another 
justification  is  a  “Dutch  book”  argument  [Fin72,Ram31],  which  shows  that  if  an  agent  uses 
some  other  method  of  updating  probabilities,  then  it  is  possible  to  construct  a  betting  game 
in  which  he  will  always  lose.  Probability  measures  are  particular  instances  of  plausibility 
measures.  Can  we  generalize  the  notion  of  conditioning  to  plausibility  measures? 

It  immediately  follows  from  the  definitions  that  the  ordering  of  the  likelihood  of  events 
induced  by  PiE  is  determined  by  the  ordering  induced  by  Pr: 

Pr(A|i?)  <  Pr(S|£l)  if  and  only  if  Pr(/i  Cl  E)  <  Pr (B  Cl  E). 

We  want  the  analogous  property  for  plausibility: 

COND  P1(A|C)  <  P1(B|C)  if  and  only  if  P1(A  C  C)  <  PI (B  D  C). 

This  rule  determines  the  order  induced  by  posterior  plausibilities.  Since  we  are  interested 
only  in  this  aspect  of  plausibility,  any  method  of  conditioning  that  satisfies  COND  will  do  for 


10  There  is  another  sense  in  which  Piy  represents  the  minimal  change  from  Pr.  If  we  measure  the 
“distance”  of  a  probability  distribution  Pp  from  Pr  in  terms  of  the  cross-entropy  of  Pp  relative 
to  Pr,  then  it  is  well  known  that  Pr^  is  the  distribution  that  minimizes  the  relative  cross-entropy 
from  Pr  among  all  distributions  Pp  such  that  PP(U)  =  1  [KL51].  Indeed,  this  holds  true  for  other 
distance  measures  as  well  [DZ82], 
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our  present  purposes.  (See  [FH95]  for  an  examination  of  other  properties  we  might  require  of 
conditioning.)  Notice  that  any  two  methods  for  conditioning  are  isomorphic  in  the  following 
sense:  Let  Si  =  (JFi,Pli)  and  S2  =  (W2,  PI2)  be  two  plausibility  spaces.  We  say  that  Si  and 
S2  are  (order)  isomorphic  if  there  is  a  Injection  h  from  W\  to  W2  such  that,  for  A,  B  C  W1: 
we  have  Pli(A)  <  Pli(S)  if  and  only  if  Pl2(h(A))  <  PI 2(h(B)).  Any  two  definitions  of 
conditioning  that  satisfy  COND  result  in  order-isomorphic  plausibility  spaces  (see  [FH95]). 

This  discussion  suggests  that  we  define  Pl^m+i,*)  to  be  the  result  of  conditioning  Pl^m^) 
on  the  new  knowledge  gained  by  agent  i  at  (r,  m  +  1).  This,  however,  leads  to  the  following 
technical  problem.  If  the  agent  gains  new  knowledge  at  (r,  m  +  1),  then  r.i(m)  ^  rj(m  +  1). 
This  implies  that  the  sets  of  points  the  agent  considers  possible  are  disjoint,  i.e. ,  /Cj(r,  m)  Cl 
K-i(r,m  + 1)  =  0.  But  then  CONS  implies  that  Pl(r,mj;)  and  Pl^m+g;)  are  defined  over  disjoint- 
spaces,  so  we  cannot  apply  COND. 

We  circumvent  this  difficulty  by  working  at  the  level  of  runs.  The  approach  we  propose 
resembles  the  Bayesian  approach  to  probabilities.  Bayesians  assume  that  agents  start  with 
priors  on  all  possible  events.  If  we  were  thinking  probabilistically,  we  could  imagine  the  agents 
in  a  multi-agent  system  starting  with  priors  on  the  runs  in  the  system.  Since  a  run  describes 
a  complete  history  over  time,  this  means  that  the  agents  are  putting  a  prior  probability 
on  the  sequences  of  events  that  could  happen.  We  would  then  expect  the  agent  to  modify 
his  prior  by  conditioning  on  whatever  information  he  has  learned.  This  is  essentially  the 
approach  taken  in  [HT93]  to  defining  how  the  agents’  probability  distribution  changes  in  a 
multi-agent  system.  We  can  do  the  analogous  thing  with  plausibility. 

We  start  by  making  the  simplifying  assumption  that  we  are  dealing  with  synchronous  systems 
where  agents  have  perfect  recall  [HV89].  Intuitively,  this  means  that  the  agents  know  what  the 
time  is  and  do  not  forget  the  observations  they  have  made.  Formally,  a  system  is  synchronous 
if  for  any  i,  ( r,m )  ( r',m ')  only  if  m  =  m! .  Notice  that  by  restricting  to  synchronous 

systems,  if  we  further  assume  that  the  plausibility  measure  Vi(r,  m )  satisfies  CONS,  we  never 
have  to  compare  the  plausibilities  of  two  different  points  on  the  same  run.  In  synchronous 
systems,  agent  i  has  perfect  recall  if  (r7,  m  +  1)  (r,  m  +  1)  implies  (r',  m )  ( r ,  m ).  Thus, 
agent  i  considers  run  r  possible  at  the  point  ( r ,  m  +  1 )  only  if  he  also  considers  it  possible 
at  ( r,m ).  This  means  that  any  runs  considered  impossible  at  (r,m)  are  also  considered 
impossible  at  (r,  m  +  1);  an  agent  does  not  forget  what  he  knew. 

Just  as  with  probability,  we  assume  that  an  agent  has  a  prior  plausibility  measure  on  runs, 
that  describes  his  prior  assessment  on  the  possible  executions  of  the  system.  As  the  agent- 
gains  knowledge,  he  updates  his  prior  by  conditioning.  More  precisely,  at-  each  point-  ( r,m ), 
t-he  agent-  conditions  his  previous  assessment-  on  t-he  set-  of  runs  considered  possible  at-  (?’,  m ). 
This  is  process  is  shown  in  Figure  2.  This  results  in  an  updated  assessment-  (posterior) 
of  t-he  plausibility  of  runs.  This  posterior  induces,  via  a  projection  from  runs  t-o  point-s,  a 
plausibility  measure  on  point-s.  We  can  think  of  agent-  i’s  posterior  at-  time  m  as  simply  his 
prior  conditioned  on  his  knowledge  at-  time  m. 

To  make  this  precise,  let-  S  =  ( W. ,  PI)  be  a  plausibility  space.  Define  t-he  projection  of  S  on 
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Fig.  2.  Schematic  description  of  how  the  agent’s  knowledge  evolves  in  time  in  synchronous  systems 
with  perfect  recall.  The  boxes  represent  the  set  of  points  in  /Cj(r,  m).  Since  the  system  is  syn¬ 
chronous,  at  each  time  point,  the  agent  consider  possible  points  at  the  same  time.  Since  the  agent 
has  perfect  recall,  as  time  progresses,  the  agent  considers  smaller  and  smaller  sets  of  runs  possible. 
The  ovals  represent  two  disjoint  events  that  correspond  to  the  same  set  of  runs. 

E  as  S\e  =  (Wj#,  PI  I#),  where  W\e  =  W  fl  E  and  Pl[jg  is  the  restriction  of  PI  to  W\e- 
Projection  is  similar  to  conditioning:  for  any  definition  of  conditioning  that  satisfies  COND 
if  A,  B  C  E.  then  P\(A\E)  <  P\(B\E)  if  and  only  if  P1|S(A)  <  Pl| E(B).  Indeed,  S\E  is 
essentially  isomorphic  to  any  conditional  plausibility  measure  that  results  from  conditioning 
on  E. 11 

We  can  now  define  what  it  means  for  a  plausibility  measure  on  points  to  be  generated  by 
a  prior.  Suppose  that  agent  i’s  prior  plausibility  at  run  r  is  V(rj)  =  ('/?.(„•;.  Plp.p).  where 
nir,  p  C  7 Z.  Our  intuition  is  that  the  agent  conditions  the  prior  by  his  knowledge  at  time 
(r,m).  In  our  framework,  the  agent’s  knowledge  at  time  m  is  the  set  of  point  7C,;(r,  m).  We 
need  to  convert  this  set  of  points  to  an  event  in  terms  of  runs.  If  A  is  a  set  of  points,  we 
define  71(A)  =  {?’  :  3m((r,  m)  E  A)}  to  be  the  set  of  runs  on  which  the  points  in  A  lie.  Using 
this  notation,  the  set  of  runs  agent  i  considers  possible  at  ( r ,  m)  is  simply  7 Z(K-i(r,  m )).  Thus, 
after  conditioning  on  this  set  of  runs,  we  get  agent  i’s  posterior  at  (r,  m),  which  is  simply 
the  projection  of  the  prior  on  the  observation:  Pl^ We  now  use  this  plausibility 
measure,  which  is  a  measure  on  a  set  of  runs,  to  define  7 ^(r,  m),  which  is  a  measure  on  a 
set  of  points.  We  do  so  in  the  most  straightforward  way:  we  project  each  run  to  a  point 
that  lies  on  it.  Formally,  we  say  that  Vi(r,m)  is  the  time  m  projection  of  T>(r-,j)|-R(/ci(r-,m)) 


11  To  make  this  precise,  we  need  a  notion  that  is  slightly  more  general  than  isomorphism.  Let 
P  =  (IT,  Pr)  be  a  probability  space.  A  set  A  is  called  a  support  of  P  if  Pr(A)  =  0.  We  can 
define  a  similar  notion  for  plausibility  spaces.  Let  S  =  (IT,  PI)  be  a  plausibility  space.  We  say  that 
A  C  W  is  a  support  of  S’,  if  for  all  B  C  W,  Pl(73)  =  Pl(i7  n  A).  Thus,  only  B  fl  A  is  relevant 
for  determining  the  plausibility  of  B.  This  certainly  implies  that  P1(A)  =  _L,  since  we  must  have 
P1(.A)  =  P1(T  fl  A)  =  P1(0),  but  the  converse  does  not  hold  in  general.  In  probability  spaces, 
Pr(A)  =  0  implies  that  Pr(i?)  =  Pr(i7  fl  A)  for  all  B ,  but  the  analogous  condition  does  not  hold 
for  arbitrary  plausibility  spaces.  We  say  that  two  plausibility  spaces  S\  and  S2  are  essentially 
(order)  isomorphic  if  there  are  supports  C\  and  C2  of  Si  and  S2,  respectively,  such  that  Si  | cs  is 
isomorphic  to  S2|c2-  It  is  easy  to  see  that,  as  expected,  essential  isomorphism  defines  an  equivalence 
relation  among  plausibility  spaces.  Finally,  it  is  easy  to  see  that  if  S  =  (IT,  PI),  then  (W,  Pl(-|£j) 
is  essentially  isomorphic  to  S\e  when  we  use  any  conditioning  method  that  satisfies  COND. 
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conditioning 


Prior  Evidence  Posterior 

Fig.  3.  Schematic  description  of  the  entities  involved  in  the  definition  of  priors.  Note  some  are 
defined  over  runs  and  some  over  points. 

if  Vi(r,m )  =  (Wm,n,  Plj|,n,o)>  where  W, =  {( r',m )  G  :  r'  G  Py,*)}  and  for 

all  d  C  we  have  that  =  Ply,«)jTC(/c .y,™))  (71(d)).  P1(,,„M)  is  the  agent’s 

plausibility  measure  at  (?’,  m).  This  process  is  described  in  Figure  3.  The  main  complications 
are  due  to  the  transition  back  and  forth  between  entities  defined  over  runs  and  ones  defined 
over  points. 

We  remark  that  if  the  system  satisfies  perfect  recall  as  well  as  synchrony,  our  original  intuition 
that  Vt  (r.  m  +  1)  should  be  the  result  of  conditioning  V,  (r.  m)  on  the  knowledge  that  agent 
i  acquires  at  ( r ,  m  +  1)  can  be  captured  more  directly.  We  can  in  fact  construct  Vi(r ,  m  +  1) 
from  Vj(r,  m)  by  what  can  be  viewed  as  conditioning  on  the  agent’s  new  information:  We  take 
Vi(r ,  m)  and  project  it  one  time  step  forward  by  replacing  each  point  ( r ' ,  m)  by  ( r' ,  m+ 1).  We 
then  condition  on  K-i(r,m  + 1)  (i.e. ,  the  agent’s  knowledge  at  (r,  m  + 1))  to  get  Vi(r,  m,i  + 1). 

Proposition  22  Let  X  be  a  synchronous  system  satisfying  perfect  recall  such  that  Ply,™,.;) 
is  the  time  m  projection  of  a  prior  Ply,*)  on  runs  for  all  runs  r,  times  m,  and  agents  i. 
Let  prev(A)  =  {(r,  m)  :  ( r,m  +  1)  G  A}.  Then  Plyjm+i)(d)  <  Plyjm+1)(i?)  if  and  only  if 
PI [r,m){prev(A))  <  PI y,m)(pret;(£>));  for  all  runs  r,  times  m,  and  sets  A,  B  G  bFy,m+i)- 


PROOF.  Straightforward;  left  to  the  reader.  □ 


We  say  that  X  =  ('JZ.  n,  V)  satisfies  PRIOR  if  X  is  synchronous  and  for  each  run  r  and  agent 
i  there  is  a  prior  plausibility  Py,*)  such  that  for  all  m,  Vj(r,m )  is  the  time  m  projection  of 

Py,0  • 

Example  23  It  is  easy  to  verify  that  the  two  systems  we  consider  in  Section  3.2  satisfy 
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PRIOR.  In  both  systems,  the  prior  V  (,■,%)  is  independent  of  the  run  r,  and  is  determined,  by 
the  failure  set  in  each  run. 

By  using  prior  plausibility  measures,  we  have  reduced  the  question  of  where  the  plausibility 
measure  at  each  point  comes  from  to  the  simpler  question  of  where  the  prior  comes  from. 
While  this  question  is  far  from  trivial,  it  is  analogous  to  a  question  that  needs  to  be  addressed 
by  anyone  using  a  Bayesian  approach.  Just  as  with  probability  theory,  in  many  applications 
there  is  a  natural  prior  (or  class  of  priors)  that  we  can  use. 

By  conditioning  on  plausibility  rather  than  probability,  we  can  deal  with  a  standard  problem 
in  the  Bayesian  approach,  that  of  conditioning  on  an  event  of  measure  0:  Notice  that  whenever 
a  prior  assigns  an  event  a  probability  measure  of  0  it  is  not  possible  to  condition  on  that 
event.  The  standard  solution  in  the  Bayesian  school  is  to  give  every  event  of  interest,  no 
matter  how  unlikely,  a  small  positive  probability. 12  We  may  well  discover  that  a  formula  (f> 
that  we  believed  to  be  true,  i.e. ,  one  that  was  true  in  all  the  most  plausible  worlds,  is  in  fact- 
false.  Under  the  probabilistic  interpretation  of  plausibility,  this  means  that  we  are  essentially 
conditioning  on  an  event  (-'(/>)  of  measure  0.  The  plausibility  approach  has  no  problem  with 
this:  the  conditioning  process  described  above  still  makes  perfect  sense. 


4-1  Conditioning  as  Minimal  Change  of  Belief 


In  this  section  we  examine  the  properties  of  conditioning  as  an  approach  to  minimal  change 
of  beliefs  and  relate  our  approach  to  others  in  the  literature. 

Recall  that  QUAL  guarantees  that  belief  is  closed  under  logical  implication  and  conjunction 
(Theorem  4).  In  a  synchronous  system  where  the  prior  satisfies  QUAL,  it  is  not  hard  to  see 
that  conditioning  preserves  QUAL.  Thus,  we  get  the  following  result. 

Proposition  24  Let  X  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  the 
prior  Pip,;)  satisfies  A2  for  all  runs  r  and  agents  i,  then  axiom  K2  is  valid  in  X  for  Bt. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


This  result  shows  that  condition  A2  is  sufficient  to  get  beliefs  that  satisfy  K2.  Is  it  also 
necessary?  In  general,  the  answer  is  no.  However,  A2  is  the  most  natural  condition  that 
ensures  that  K2  is  satisfied.  To  see  this,  note  that  if  K2  is  valid  in  X  then  A2  holds  for  all 
pairwise  disjoint  subsets  Ai,  A2  and  A3  of  points  in  X  definable  in  the  language  such  that 
7 Z()Ci(r,m))  =  Ai  U  A2  U  A3  for  some  run  r,  agent  i,  and  time  m.  Thus,  if  we  assume  that 
the  language  is  rich  enough  so  that  all  subsets  of  X  are  definable  (in  that,  for  each  subset  A 

12  Of  course,  this  requires  that  there  be  only  countably  many  events  of  interest. 
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and  agent  i,  there  is  a  formula  (f  and  point  (r,m)  such  that  A  =  |^J(r,m,i)),  then  K2  forces 
A2. 

In  view  of  this  discussion,  we  focus  in  this  section  on  synchronous  systems  with  a  qualitative 
prior. 

Next,  we  examine  how  changes  in  beliefs  are  determined  by  the  prior.  Using  Proposition  22, 
we  now  show  that  we  can  characterize,  within  our  language,  how  the  agent’s  beliefs  change 
via  conditioning,  provided  that  we  can  describe  in  the  language  what  knowledge  the  agent 
acquired.  We  say  that  a  formula  (p  characterizes  agent  i  ’s  knowledge  at  (r,  m  + 1)  with  respect 
to  his  knowledge  at  ( r ,  m )  if,  for  all  (r',  m)  6  /Cj(r,  m),  we  have  (r',  m  +  1)  \=  (j)  if  and  only  if 
m  +  I )  G  /Cj(r,  m  +  1).  That  is,  among  the  points  that  succeed  points  that  are  considered 
possible  at  time  m,  exactly  these  satisfying  <p  are  considered  possible  at  time  m  +  1.  Of 
course,  it  is  not  always  possible  to  characterize  the  agent’s  new  knowledge  by  a  formula  in 
our  language.  However,  in  many  applications  we  can  limit  our  attention  to  systems  where 
it  is  possible.  (This  is  the  case,  for  example,  in  our  treatment  of  revision  and  update  in 
[Fri97,FH97a].)  In  such  systems,  we  can  characterize  within  the  agent’s  belief  change  process 
in  the  language. 

Proposition  25  Let  X  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR,.  If  f> 
characterizes  agent  i’s  knowledge  at  (r,m  +  1)  with  respect  to  his  knowledge  at  (r, m),  then 
(l,r,m  +  1)  (=  ip ->i  £  if  and  only  if  ( X ,  r,  m)  |=  0{<j>  A  +)  GO 

PROOF.  See  Appendix  A. 4.  □ 

Corollary  26  Let  X  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  <f 
characterizes  agent  i’s  knowledge  at  (r,  m  +  1)  with  respect  to  his  knowledge  at  (r,  m),  then 
(X,  r,  m  +  1)  |=  B.j'ip  if  and  only  if  ( X ,  r,  m)  |=  KjfQcf  =>-  (O <t>  — +  O'G)-  Moreover,  ifX  also 
satisfies  SDP ,  then  (X,  r,  m  +  1)  |=  Byip  if  and  only  if  (X,  r,  m)  |=  O 4>  ~+  OV’- 

We  now  use  this  result  to  relate  our  approach  to  other  approaches  for  modeling  conditionals 
in  the  literature.  Boutilier  [Bou92] ,  Goldszmidt  and  Pearl  [GP92] ,  and  Lamarre  and  Shoham 
[LS94]  give  conditional  statements  similar  semantics  (using  a  preference  ordering),  but  <fi  — *  if 
is  read  “after  learning  <f>,  'if  is  believed” .  Two  crucial  assumptions  are  made  in  these  papers. 
The  first  is  that  the  agent  considers  only  one  plausibility  assessment,  which  in  our  terminology 
amounts  to  SDP.  The  second  is  that  propositions  are  static,  i.e.,  their  truth  value  does  not 
change  along  a  run. 13  Formally,  a  system  is  static  if  7r (r(m))  =  7r(?’(0))  f°r  runs  r  and 
times  m.  This  implies  that  for  any  propositional  formula  <f>,  we  have  that  </>  =  Qcf.  These 
two  assumptions  lead  to  a  characterization  of  belief  change. 

Corollary  27  Let  X  be  a  synchronous  static  system  satisfying  PRIOR,  SDP,  and  perfect 
recall,  and  let  <f  and  if  be  propositional  formulas.  If  <f>  characterizes  agent  i ’s  knowledge  at 

13  This  assumption  is  only  implicit,  since  none  of  these  papers  have  an  explicit  representation  of 
time.  Nevertheless,  it  is  clear  that  this  assumption  is  being  made. 
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(r,m+  1)  with  respect  to  his  knowledge  at  ( r,m )  ,  then  {1.  r,  m  +  1)  |=  Bpf  if  and  only  if 
(I,  r,  m)  |=  0  if. 

While  this  result  shows  that,  in  certain  contexts,  there  is  a  connection  between  a  statement 
such  as  “typically  0’s  are  0’s”  (which  is  how  we  have  between  interpreting  0  — q  if)  and  “after 
learning  0,  if  is  believed"  (which  is  how  it  is  interpreted  in  [Bou92,GP92,LS94]),  the  two 
readings  are  in  general  quite  different.  For  one  thing,  notice  that  Corollary  27  assumes  that  0 
and  if  are  propositional  formulas.  This  is  a  necessary  assumption.  If  0  and  if  contain  modal 
formulas,  then  0  — >  if  does  not  necessarily  imply  that  the  agent  believes  if  at  the  next  time 
step.  For  example,  if  (X,  r,  m )  |=  Biif,  then  for  any  formula  0,  we  have  (1,  r,m )  |=  0  — q  Biif, 
regardless  of  whether  B^if  is  believed  at  (r,  m  +  1).  In  [FH94b],  we  examine  conditionals  of 
the  form  0  >  if  intended  to  capture  the  second  interpretation  “if  is  believed  after  learning 
0” .  The  semantics  for  these  conditionals  involves  examining  future  time  points,  just  as  our 
intuitive  reading  dictates.  As  we  have  just  seen,  >  and  — >  are  quite  different  when  we  consider 
modal  formulas  in  the  scope  of  these  conditionals. 

This  discussion  shows  one  of  the  benefits  of  representing  time  explicitly.  In  our  framework 
we  can  distinguish  between  agents’  plausibility  assessment  and  their  belief  dynamics.  Of 
course,  we  would  like  agents  to  be  persistent  in  their  assessment,  which  is  exactly  what 
conditioning  captures.  In  the  presence  of  several  assumptions,  we  get  a  close  connection 
between  agents’  conditional  beliefs  and  how  their  beliefs  change.  This  allows  us  to  identify 
some  of  the  assumptions  implicitly  made  in  previous  approaches.  For  example,  all  of  the 
approaches  we  mentioned  above  would  not  apply  when  we  consider  a  changing  environment, 
since  they  cannot  reason  about  how  the  environment  changes  between  one  time  point  and 
the  next. 

Finally,  we  examine  the  work  of  Battigalli  and  Bonanno  [BB97].  They  consider  a  logic  of 
knowledge,  belief,  and  time,  and  attempt  to  capture  properties  of  “minimal  change”  of  beliefs. 
Their  language  is  slightly  different  from  ours.  Instead  of  introducing  a  temporal  modality, 
they  define  a  different  belief  and  knowledge  modality  for  each  time  step:  £>*0  reads  “the 
agent  believes  0  at  time  f  ’ .  Battigalli  and  Bonanno  also  assume  that  propositions  are  static 
and  do  not  change  in  time.  Thus,  the  only  changes  are  in  terms  of  the  agent’s  knowledge 
and  belief.  Battigalli  and  Bonanno  propose  an  axiom  system  similar  to  the  axioms  of  Kraus 
and  Lehmann  (that  is,  they  use  K5  for  knowledge  is  K5,  KD45  for  belief,  and  take  axioms 
KB1  and  KB2  of  Section  2.7  to  characterize  the  connection  between  knowledge  and  belief) 
that  also  includes  two  additional  axioms  that  can  be  written  in  our  language  as 

BT1.  BiOBicf  =^>  Bi(f 
BT2.  Bi(f  =t>  BiOBif) 

Battigalli  and  Bonanno  claim  that  these  axioms  capture  the  principle  that  the  agent  does 
not  change  her  mind  unless  new  knowledge  forces  her  to  do  so.  Intuitively,  this  principle 
also  applies  to  conditioning,  and  thus  it  is  instructive  to  understand  when  these  axioms  are 
satisfied  in  our  framework. 
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It  turns  out  that  RANK  combined  with  a  minimal  assumption  implies  both  BT1  and  BT2. 
We  say  that  a  system  has  finite  branching  if  it  allows  only  finitely  many  “branches”  at  each 
local  state  of  an  agent  (that  is  there  are  only  finitely  many  observations  that  an  agent  can 
make  at  each  point). 

Lemma  28  Let  X  be  a  synchronous  static  system  satisfying  PRIOR ,  RANK ,  SDP,  and 
perfect  recall  that  has  finite  branching.  Then  ( X ,  r,  m)  j=  Bifi  BiQBjcf)  for  all  propositional 
formulas  <f>. 


PROOF.  See  Appendix  A. 4.  □ 


Are  these  conditions  necessary  to  characterize  BT1  and  BT2?  The  answer  is  no.  First,  the 
proof  of  Lemma  28  applies  to  systems  with  infinite  branching,  if  the  agents’  prior  satisfies 
an  inhnitary  version  of  A2.  As  shown  in  [FHK96],  this  infinitary  version  is  satisfied  by 
K-rankings  and  preference  orderings  that  are  well  founded  (that  is,  they  have  no  infinite 
descending  sequences  •  •  •  -<  w3  -<  w2  A  wfij.  Thus,  any  system  with  static  propositions 
whose  prior  is  induced  by  a  well-founded  preference  order  satisfies  BT1  and  BT2.  Note  that 
BT1  and  BT2  do  not  characterize  RANK,  since  they  put  restrictions  only  on  certain  events 
(ones  definable  by  a  conjunction  of  a  formula  and  the  agent’s  new  knowledge  at  some  time 
point).  However,  RANK  is  the  most  natural  restriction  that  implies  these  axioms. 

Thus,  we  see  that  Battigalli  and  Bonanno  essentially  require  systems  with  minimal  change 
to  satisfy  conditioning  with  a  prior  that  is  a  ranking.  As  we  shall  see  in  the  next  section, 
similar  requirements  are  made  by  the  AGM  formulation  of  belief  revision  [AGM85] . 


f.2  Properties  of  Prior  Plausibilities 


If  we  take  the  plausibilities  in  a  system  to  be  generated  by  a  prior,  then  many  of  the  conditions 
we  are  interested  in,  such  as  QUAL  and  REF,  can  be  viewed  as  being  as  being  induced 
by  the  analogous  property  on  the  prior.  We  have  considered  these  properties  only  in  the 
context  of  Kripke  structures  for  knowledge  and  probability,  so  to  make  sense  of  the  prior 
having  the  “analogous  property” ,  we  have  to  be  able  to  view  the  set  of  runs  as  a  Kripke 
structure  for  knowledge  and  probability.  Let  X  be  a  synchronous  system  satisfying  perfect 
recall  and  PRIOR.  Define  Mj  —  (71,  KXn ,  V\, . . . ,  Vfi),  where  irr  is  an  arbitrary 

truth  assignment,  IQ-  is  the  full  relation,  i.e. ,  71x71,  and  Vf(r)  =  V(r,i),  the  prior  of  agent  i 
at  run  r. 

Proposition  29  Let  X  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  Mf 
satisfies  QUAL,  REF,  SDP,  UNIF  or  RANK,  then  so  does  X. 


PROOF.  Straightforward;  left  to  the  reader.  □ 
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Thus,  by  constructing  priors  that  satisfy  various  properties,  we  can  ensure  that  the  resulting 
system  also  satisfies  them.  In  particular,  Proposition  29  implies  that  if  Vfci)  is  independent 
of  r,  so  that  agent  i’s  prior  is  independent  of  the  run  he  is  in,  then  X  satisfies  SDP.  A 
somewhat  weaker  assumption — that  the  set  of  runs  can  be  partitioned  into  disjoint  subsets 
. .  'R,k  such  that  for  r,rf  E  7 Zj,  we  have  V(r,i)  =  'P(r'£>>  ~  (7?-j.  I’lj) — ensures  that  X 
satisfies  UNIF.  Intuitively,  the  sets  7 Zj  correspond  to  different  settings  of  parameters.  Once 
we  set  the  parameters,  then  we  fix  the  plausibility  measure  (and  it  is  the  same  at  all  runs 
that  have  the  same  setting  of  the  parameters). 

We  conclude  this  section  by  examining  whether  assuming  conditioning  limits  the  expres¬ 
siveness  of  our  belief  change  operation.  A  well-known  result  of  Diaconis  and  Zabell  [DZ82] 
that  shows  that,  in  a  precise  sense,  any  form  of  coherent  probabilistic  belief  change  can  be 
described  by  conditioning.  In  particular,  they  show  that,  given  two  probability  distributions 
Pr  and  lV  on  a  finite  space  W  that  are  coherent  in  the  sense  that  Pr(A)  =  0  implies  that 
Pr^A)  =  0,  there  is  a  space  W*  of  the  form  W  x  X,  a  subset  E  of  W*,  and  a  distribution 
Pr"  on  W*  such  that,  for  all  A  C  W,  we  have  Pr"(A  x  X)  =  Pr(A)  (so  that  Pr"  can  be 
viewed  as  an  extension  of  Pr)  and  Pr'(A)  =  Pr"(A  x  X\E). 

We  can  prove  a  result  in  a  somewhat  similar  spirit  in  our  framework.  The  first  step  is  to 
define  a  plausibilistic  analogue  of  coherence  in  systems. 

Let  X  be  a  synchronous  system.  We  say  that  X  is  coherent  if  the  following  condition  is 
satisfied  for  all  r  and  m:  Suppose  R  C  TZ,  Am  C  IV (r,mA) ,  7 Z(Am)  =  RVlZ(W^mjf),  Am+1  C 
A  (r,m+l,i)  ]  and  7 Z(Am+1)  =  RnTZ(W(rm+i,i))-  If  Pip, m,*)(Am)  =  T,  then  Pl(nw+i,p(Am+1)  = 
T.  Despite  the  different  formulation,  this  condition  is  analogous  to  the  probabilistic  coherence 
of  Diaconis  and  Zabell.  Roughly  speaking,  if  a  set  of  runs  has  plausibility  A  (which  is 
analogous  to  probability  0  for  Diaconis  and  Zabell)  at  time  m,  then  it  is  required  to  have 
plausibility  T  at  time  m+  1.  More  precisely,  coherence  of  a  system  ensures  that  sets  of  runs 
that  were  considered  implausible  at  (r,  m),  either  by  being  outside  IV (r.m.i)  or  by  being  given 
plausibility  are  also  considered  implausible  at  (r,m  +  1).  Note,  this  condition  does 

not  put  any  constraints  on  how  the  runs  that  are  considered  possible  are  ordered.  It  is  easy 
to  verify  that  the  following  axiom  is  valid  in  coherent  systems: 

COH.  =>  ONi<f> 

Proposition  30  If  1  is  a  synchronous  and  coherent  system,  then  COH  is  valid  in  X. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


There  is  a  sense  in  which  the  converse  to  Proposition  30  holds  as  well:  Given  a  synchronous 
system  that  is  not  coherent,  we  can  define  a  truth  assignment  n  in  this  system  for  which 
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COH  does  not  hold. 14 


It  is  easy  to  see  that  coherence  is  a  necessary  condition  for  satisfying  PRIOR. 

Proposition  31  If  1  is  a  synchronous  system  satisfying  perfect  recall  and  PRIOR ,  then  X 
is  coherent. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


Thus,  PRIOR  forces  systems  to  be  coherent,  and  hence  to  satisfy  COH.  It  also  forces  systems 
to  satisfy  CONS,  and  hence  C5.  As  we  shall  see,  it  also  forces  some  other  semantic  properties. 
Nevertheless,  we  can  show  that  for  coherent  systems  that  satisfy  CONS,  PRIOR  does  not 
force  any  additional  properties,  by  proving  an  analogue  to  the  Diaconis  and  Zabell  result  in 
our  framework. 

We  say  that  a  formula  cf  E  CKCT  is  temporally  linear  if  temporal  modalities  in  cf>  do  not 
appear  in  the  scope  of  the  /C,  or  — **  modalities.  Thus,  for  example,  a  formula  such  as 
((f)  —>i  if)  =>-  O Biif  is  temporally  linear,  while  KjfQcf  — Q'tf)  =>-  QBiif  is  not.  Temporal 
linearity  ensures  that  all  the  temporal  connectives  in  cf  are  evaluated  with  respect  to  a  single 
run.  The  following  result  says  that,  at  least  for  temporally  linear  formulas,  we  can  view  belief 
change  in  a  coherent  system  X  as  coming  from  conditioning  on  a  prior,  in  the  sense  that  we 
can  embed  X  into  a  larger  system  where  this  is  the  case. 

Theorem  32  Let  A  be  a  subset  of  { QUAL ,  NORM ,  REF ,  RANK]  and  let  X  be  a  coherent 
synchronous  system  satisfying  perfect  recall,  CONS,  and  A.  Then  there  is  a  synchronous 
system  X 1  satisfying  perfect  recall,  PRIOR,  and  A ,  and  a  mapping  f  :  IZ  i— >•  IZ'  such  that  for 
all  temporally  linear  formulas  (f  E  CKCT ,  we  have  (X,  r,  m )  |=  <f>  if  and  only  if  (X1 ,  /(?’),  m )  |= 


PROOF.  See  Appendix  A. 5.  □ 


Notice  that  formulas  that  just  compare  an  agent’s  beliefs  (or  knowledge)  at  successive  time 
points  are  temporally  linear.  All  the  ACM  postulates  and  the  KM  postulates  (when  trans¬ 
lated  to  our  language)  are  of  this  form.  Not  surprisingly,  as  we  show  in  [Fri97,FH97a],  these 
postulates  can  be  captured  by  systems  with  the  appropriate  prior  plausibility. 

14  We  remark  that  COH  is  analogous  to  the  axiom  KiQf  O Ki<f>  that  characterizes  perfect  recall 
in  synchronous  systems  [FHMV95].  Roughly  speaking,  this  is  because  coherence  ensures  that  the 
agent  does  not  forget  what  she  ruled  out  as  implausible. 

15  We  note  that  this  result  is,  in  a  sense,  stronger  than  Diaconis  and  Zabelbs.  They  examine  only 
the  probability  of  events,  which  are  essentially  propositional  formulas  (i.e.,  formulas  without  modal 
operators). 
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Can  we  extend  Theorem  32  to  the  full  language?  We  conjecture  that  Theorem  32  actually 
holds  for  all  <fi  G  CKCT ,  not  just  temporally  linear  formulas.  This  conjecture  implies  that  a 
formula  is  valid  with  respect  to  synchronous  systems  satisfying  perfect  recall,  CONS,  and 
PRIOR,  if  and  only  if  it  is  valid  with  respect  to  synchronous  coherent  systems  satisfying 
CONS  and  perfect  recall.  That  is,  except  for  COH  and  C9,  we  do  not  get  any  new  properties 
by  assuming  PRIOR  and  CONS. 

Note  that  the  construction  described  by  Theorem  32  does  not  necessarily  preserve  SDP  or 
UNIF  in  the  transformation  from  X  to  X' .  This  is  due  to  the  fact  that  in  the  presence  of  SDP 
or  UNIF,  PRIOR  forces  new  semantic  properties.  Recall  that  UNIF  implies  that  there  is  a 
partition  of  possible  points  such  that  two  points  (?’,  m )  and  (r1 ,  ml)  are  in  the  same  cell  if  and 
only  if  Vi{r,m )  =  Vfir'  ,m').  Let  PERSIST  be  the  requirement  that  this  partition  changes 
minimally  in  time.  More  precisely,  we  say  that  a  system  satisfies  PERSIST  if  for  all  runs 
r,  r'  G  IZ  and  m  such  that  (r,  m  + 1)  (r',  m+ 1),  we  have  that  Vi(r,  m  + 1)  =  Vi(r',m  + 1)  if 

and  only  if  Vfir,  m )  =  Vfir',  m ).  Intuitively,  PERSIST  (in  the  presence  of  synchrony,  perfect 
recall,  and  CONS)  implies  that  the  partition  of  points  at  time  m  +  1  is  determined  by  the 
partition  of  corresponding  points  at  time  m  and  the  knowledge  relation  at  time  m  +  1. 

Proposition  33  IfX  is  a  synchronous  system  that  satisfies  perfect  recall  and  either  PRIOR 
and  UNIF,  or  SDP,  then  X  satisfies  PERSIST. 


PROOF.  Straightforward;  left  to  the  reader.  □ 


It  is  not  clear  to  us  at  this  stage  whether  PERSIST  forces  new  properties  in  our  language. 
However,  if  we  assume  that  PERSIST  holds,  we  can  get  a  result  analogous  to  Theorem  32. 

Theorem  34  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  SDP,  UNIF,  RANK]  and  let  X 
be  a  coherent  synchronous  system  satisfying  perfect  recall,  CONS,  PERSIST,  and  A.  Then 
there  is  a  synchronous  system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping 
f  :  IZ  i— >•  IZ'  such  that  for  all  temporally  linear  formulas  4>  G  CKCT ,  (X,  r,m)  \=  <j>  if  and  only 
if  (Z',f(r),m)  |=  (f>. 


PROOF.  See  Appendix  A. 5.  □ 


Thus,  the  question  of  whether  PRIOR  forces  new  properties  in  the  presence  of  UNIF  re¬ 
duces  to  the  question  of  whether  PERSIST  forces  new  properties.  Finally,  since  SDP  implies 
PERSIST,  PRIOR  does  not  force  new  properties  in  the  presence  of  SDP. 

Our  discussion  of  conditioning  and  priors  up  to  now  assumed  synchrony  and  perfect  recall. 
Can  we  make  sense  of  conditioning  when  we  relax  these  assumptions?  Note  that  the  definition 
of  PRIOR  does  not  rely  on  perfect  recall.  PRIOR  is  well  defined  even  in  systems  where 
agents  can  forget.  However,  in  such  systems,  the  intuitions  that  motivated  the  use  of  PRIOR 


41 


are  no  longer  valid.  In  particular,  PRIOR  does  not  imply  coherence  and  the  analogue  to 
Proposition  22  does  not  hold:  we  no  longer  can  construct  Vi(r,m  +  1)  from  Vi(r,m)  since 
runs  that  are  considered  impossible  at  time  m  might  be  considered  possible  at  time  m  + 1. 16 
Dropping  the  assumption  of  synchrony  also  leads  to  problems,  even  in  the  presence  of  perfect 
recall.  In  an  asynchronous  setting,  an  agent  might  consider  several  points  on  the  same  run 
possible.  The  question  then  arises  as  to  how  (or  whether)  we  should  distribute  the  plausibility 
of  a  run  over  these  points.  Two  approaches  are  considered  in  a  probabilistic  setting  in  [PR97], 
in  the  context  of  analyzing  games  with  imperfect  recall.  It  would  be  of  interest  to  see  to  what 
extent  these  approaches  can  be  carried  over  to  the  plausibilistic  setting. 


5  Conclusion 


We  have  proposed  a  framework  for  belief  dynamics  that  combines  knowledge,  time,  and 
plausibility  (and  hence  beliefs),  and  investigated  a  number  of  properties  of  the  framework, 
such  as  complete  axiomatizations  for  various  sublanguages  and  various  properties  of  the 
relationships  between  the  modal  operators.  Of  course,  the  obvious  question  is  why  we  should 
consider  this  framework  at  all. 

There  are  two  features  that  distinguish  our  approach  from  others.  The  first  is  that  we  use 
plausibility  to  model  uncertainty,  rather  than  other  approaches  that  have  been  mentioned  in 
the  literature,  such  as  preference  orderings  on  worlds  or  e-semantics.  The  second  is  that  we 
include  knowledge  and  time,  as  well  as  belief,  explicitly  in  the  framework. 

We  could  have  easily  modified  the  framework  to  use  other  ways  of  modeling  uncertainty. 
Indeed,  in  a  preliminary  version  of  this  paper  [FH94c],  we  used  preference  orderings.  We  have 
chosen  to  use  plausibility  measures  for  several  reasons.  First,  plausibility  measures  generalize 
all  approaches  to  representing  uncertainty  that  we  are  aware  of.  The  use  of  plausibility  makes 
it  easier  to  compare  our  approach,  not  only  to  preference-based  approaches  (e.g.,  [Bou92]), 
but  also  to  approaches  based  on  K-rankings  (e.g.,  [GP92]),  probably  measures  (e.g.,  [HT93]), 
or  any  other  measure  of  uncertainty.  More  importantly,  it  makes  it  easier  for  us  to  incorporate 
intuitions  from  other  approaches.  We  have  already  seen  one  example  of  this  phenomenon 
in  the  present  paper:  we  defined  a  plausibilistic  analogue  of  conditioning,  and  used  it  to 
model  minimal  change.  As  we  show  in  [FH97a],  we  can  represent  the  standard  approaches  to 
minimal  change — belief  revision  and  belief  update — in  terms  of  conditioning.  Moreover,  the 
semantic  characterization  of  conditioning  should  allow  us  to  apply  it  more  easily  to  deal  with 
complications  that  arise  when  the  language  lets  us  reason  about  multiple  agents,  actions, 
and  beliefs  about  beliefs.  Another  example  of  adopting  probabilistic  intuitions  is  given  in 
[Fri97,FH95,FH96b],  where  plausibilistic  analogues  of  independence  and  Markov  chains  are 
described  and  used  to  define  a  novel  approach  to  belief  change.  We  believe  that  these  notions 
will  have  applications  elsewhere  as  well.  Finally,  plausibility  measures  have  the  advantage  of 

16  We  could,  of  course,  redefine  PRIOR  so  as  to  guarantee  that  Proposition  22  holds,  but  this  leads 
to  other  complications. 
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greater  expressive  power  than  other  approaches.  For  example,  work  on  defaults  has  mainly 
focused  on  properties  of  structures  with  a  finite  number  of  worlds.  In  our  framework,  however, 
even  a  simple  system  with  two  global  states  might  have  an  uncountable  number  of  runs. 
As  shown  in  [FHK96],  once  we  examine  structures  with  infinitely  many  worlds,  qualitative 
plausibility  measures  can  capture  natural  ordering  of  events  that  cannot  be  captured  by 
preference  orderings,  possibility  measures,  or  k- rankings. 


As  we  have  tried  to  argue  throughout  the  paper,  the  explicit  representation  of  knowledge  and 
time  makes  it  much  easier  to  study  belief  dynamics.  Most  current  work  in  the  area  examines 
only  the  beliefs  of  an  agent  and  how  they  change  after  incorporating  a  new  belief.  Many 
simplifying  assumptions  are  made:  that  there  is  a  single  agent,  that  the  agent’s  knowledge 
does  not  change,  that  new  information  can  be  characterized  in  the  language,  and  so  on. 
It  is  useful  to  study  this  simple  setting  in  order  to  get  at  the  basic  issues  of  belief  change. 
However,  these  simplifying  assumptions  are  not  suitable  when  we  want  examine  belief  change 
in  more  realistic  settings  (such  as  the  diagnosis  example  of  Section  3.2).  This  means  that 
most  of  the  results  in  the  current  belief  change  literature  are  not  directly  applicable  in  many 
standard  AI  problems.  Our  framework  dispenses  with  most  of  the  simplifying  assumptions 
made  in  the  literature,  and  thus  can  be  viewed  as  a  first  step  towards  providing  a  model  of 
more  realistic  settings  of  belief  change. 


We  have  focused  here  on  the  foundations  of  the  framework.  In  the  future,  we  hope  to  apply 
the  framework  to  examine  more  realistic  problems.  We  have  already  begun  to  do  this.  For 
example,  in  [FH94c]  we  provide  a  detailed  analysis  of  iterated  prisoner  dilemma  games  be¬ 
tween  two  agents.  It  is  well-known  that  the  players  cannot  cooperate  when  they  have  common 
knowledge  of  rationality.  However,  we  show  that  they  can  cooperate  when  they  have  com¬ 
mon  belief  of  rationality.  A  recent  proposal  by  van  der  Meyden  [Mey94]  for  multi-agent  belief 
change  can  easily  be  embedded  in  our  framework  [van94] .  We  hope  to  use  our  framework  to 
study  some  of  the  problems  considered  by  van  der  Meyden,  such  as  speech-act  semantics. 
Another  natural  application  area  is  reasoning  about  actions  and  planning  in  the  presence  of 
uncertainty.  We  believe  that  the  flexibility  and  expressive  power  of  the  framework  will  help 
to  clarify  what  is  going  on  in  all  these  areas. 
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A  Proofs 


A.l  Proofs  for  Section  2.1 


Theorem  7:  K  (resp.,  Kf5,  KDf  5 )  is  a  sound  and  complete  axiomatization  for  CB  with 
respect  to  M.  (resp.,  A4C0NS,  7V4CONS,NORMy). 


PROOF.  As  usual,  soundness  is  straightforward,  so  we  focus  on  completeness.  We  prove 
completeness  by  showing  that  for  M  G  M.K  (resp.  M. f£,  M.^)  there  is  a  structure  M+  G  A4 
(resp.  MC0NS,  _A4cons,norm)  such  that  for  all  <f>  G  CB ,  we  have  ( M,w )  |=  <f>  if  and  only  if 
(. M+  ,w )  |=  <f>.  Completeness  then  follows  from  Theorem  f. 

Let  M  =  . . .  ,Bn)  be  a  Kripke  structure  for  belief.  We  construct  a  Kripke  struc¬ 

ture  for  knowledge  and  plausibility  M+  =  (W,  7r,  /Ci , . . . ,  JCn,  Pi, ... ,  Vn)  as  follows.  We 
set  JCi(w)  to  be  the  set  of  worlds  where  agent  i’s  beliefs  are  the  same  as  in  w.  Formally, 
(w,v)  G  K-i  if  Bjfw )  =  Bjfv).  It  is  easy  to  verify  that  fCt  is  an  equivalence  relation.  We  dehne 
Vi(w)  =  (li  Pl(u,,i)),  where  W(w$  =  Bjfw )  is  the  set  of  worlds  agent  i  considers  possible, 
Pl(io,i)(0)  =  0;  and  Pl(„,!p(A)  is  1  if  A  C  \V(W:l'j  is  not  empty  It  is  easy  to  verify  that  these 
(trivial)  plausibility  measures  are  qualitative. 

We  now  prove  that  (. M,w )  |=  </>  if  and  only  ( M+,w )  |=  < p  for  any  < \ >  G  CB .  This  is  shown 
by  induction  on  the  structure  of  cj>.  The  only  interesting  case  is  if  <p  is  of  the  form  Bi<f>' . 
Assume  ( M,w )  |=  .  We  want  to  show  that  ( M+,w )  |=  Kjftrue  — 4>').  We  start  by 

noting  that  (w,v)  G  JCj  if  and  only  if  Bjfv)  =  Bjfw).  This  implies  that  Vjfv)  =  Vjfw).  Thus, 
(M+,v)  |=  true  — q  <p'  if  and  only  if  ( M+,w )  |=  true  ~^j  <f>' .  Thus,  it  suffices  to  show  that 
(. M+,w )  |=  true  — q  since  this  implies  that  ( M+,w )  |=  Kjftrue  — q  <ff),  i.e.,  ( M+,w )  J= 

Bjf> .  There  are  two  cases.  If  Bjfw)  =  0,  then  =  0.  This  implies  that  true  — q  <f>' 

holds  vacuously.  If  Bjfw)  is  not  empty,  then  using  the  induction  hypothesis  we  conclude  that 
[01  =  Bjfw).  From  the  definition  of  Pl(w,p  we  conclude  that  Pl(«,,j)([0,](lt,,i))  =  1  and  that 

=  Thus’  ( M+,w )  |=  true  <j/  and  hence  ( M+,w )  \=  Kjftrue  ~^j  $). 
Now  assume  (. M,w )  |=  -i Bj<f> .  Then  there  is  some  v  G  Bjfw )  such  that  (M,v)  |=  -<$. 
Using  the  induction  hypothesis  we  conclude  that  PI^pQ-k//]^))  =  1.  Hence,  ( M+,w )  \= 
-i (true —>j  <f)')  and  therefore,  (M+,iu)  f=  -i Kj(true—>j  <f>'). 

It  remains  to  show  that  if  M  G  then  M+  satisfies  CONS,  and  if  M  G  then  M+ 

also  satisfies  NORM.  Assume  Bt  is  transitive  and  Euclidean.  Let  w  and  v  be  worlds  such 
that  (w,v)  G  Bj.  We  claim  that  Bjfw)  =  Bjfv).  If  (w,t)  G  Bt,  then  since  B,  is  Euclidean  we 
get  that  (v,t)  G  Bt.  If  (v,t)  G  Bj.  then  since  Bj  is  transitive  we  get  that  (w,t)  G  Bt.  Thus, 
Bjfv)  =  Bjfw),  as  desired.  Recall  that  if  Bjfv)  =  Bjfw),  then  our  construction  ensures  that 
v  G  JCjfw).  Hence,  Bjfw)  C  )Cjfw)  and  M+  satisfies  CONS.  Assume  that  B,  is  serial.  This 
implies  that  for  all  w,  Bjfw)  is  not  empty.  Thus,  our  construction  guarantees  that  W(wa  is 
not  empty  and  l>l(„;,i;(H'(,«,i;)  >-  □ 
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Theorem  8:  AXKB  ( resp AXKB,C0NS,  AXKB’C0NS,N0RMy)  is  a  sound  and  complete  axiom- 
atization  of  CKB  with  respect  to  M  (resp.,  A4C0NS,  A^C0NS,N0RMJ. 


PROOF.  Again  soundness  is  straightforward,  so  we  focus  on  completeness.  We  sketch  a 
completeness  proof  following  the  usual  Makinson  [Mak66]  style  of  proof.  We  describe  only 
the  parts  that  are  different  from  the  standard  proofs.  See,  for  example,  Halpern  and  Moses 
[HM92]  for  details. 

In  order  to  prove  completeness,  we  need  only  show  that  if  the  formula  <p  is  consistent  with  the 
axiom  system  (i.e.,  AXKB,  AXKB’C0NS  or  AXKB’C0NS’N0RM)  then  <j>  is  satisfiable  in  a  Kripke 
structure  of  the  appropriate  class  (i.e.,  M,  AdC0NS,  or  AdC0NS,N0RM,  respectively). 

Let  V  be  a  set  of  formulas  and  AX  an  axiom  system.  We  say  that  V  is  AX-consistent  if  for 

all  <f>i , . . .  <j>n  E  V,  it  is  not  the  case  that  AX  I - i(Ai  A  ...  A  </>n).  The  set  V  is  a  maximal 

consistent  set  if  it  is  consistent,  and  for  each  formula  <f> ,  either  f  E  V  or  -i <f)  E  V. 

We  now  build  a  canonical  model  MKB  for  AXKB,  in  which  every  AXKB-consistent  formula  is 
satisfiable.  MKB  has  a  world  wy  corresponding  to  every  maximal  AXKB-consistent  set  V  of 
formulas;  we  show  that  (MKB,  wy)  \=  (f>  if  and  only  if  <f>  E  V. 

We  proceed  as  follows.  If  V  is  a  set  of  formulas,  dehne  V/K t  =  {f>  :  Kpp  E  V}  and  V j B,t  = 
{</>  :  Bi(j>  e  V}.  Let  MKB  =  (W,  tt,  JCy  . . . ,  Kn,  Vt,  ...,Vn),  where 

•  W  =  {wy  :  V  is  a  maximal  AXKB-consistent  set  of  formulas} 

•  7i (wy)(p)  =  true  if  and  only  if  p  E  V 

•  JCi  =  {( wv,wu )  :  1 7 K,  c  u} 

•  Vifwy )  =  (W(lt,Vji),Pl(„,w0),  where  W(t0Vi^  =  {wv  :  Vj Bj  C  [/},  Pl(wv^(0)  =  0,  and 
Pl(Wji)(A)  =  1  for  A  7  0. 

Using  standard  arguments,  it  is  easy  to  show  that  the  /C/s  are  equivalence  relations  (see 
[HM92]).  Using  a  standard  induction  argument,  we  can  verify  that  (MKB,wy)  \=  <p  if  and 
only  if  (j)  E  V. 

This  construction  proves  completeness  for  AXKB.  To  prove  completeness  for  the  other  two 
variants  we  use  the  same  construction,  setting  lU  to  correspond  to  the  maximal  AXKB,C0NS- 
consistent  sets  (resp.  AXKB’CONS’NORM-consistent  sets).  We  must  show  that  the  resulting 
canonical  models  satisfy  CONS  and  NORM,  respectively. 

Let  JyfKB’C0NS  be  the  canonical  model  constructed  for  AXKB,C0NS.  To  show  that  MKB,C0NS 
satisfies  CONS,  it  is  enough  to  show  that  U/A/  C  V / Bt .  To  show  this,  assume  f>  E  V/Kj. 
Then  K,(p  e  V.  Since  KB2  E  AXKB,C0NS,  we  conclude  that  B,@  E  V.  and  thus  A  E  V /By 

Let  AfKB’C0NS,N0RM  be  the  canonical  model  constructed  for  AXKB’C0NS,N0RM.  The  argu¬ 
ment  above  shows  that  mkb,cons’norm  satisfies  CONS.  To  show  that  it  satisfies  NORM, 
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i.e.,  Pl(«.,j)(l/t/(.u,!j))  >_L,  it  is  enough  to  show  that  V/Bj  is  consistent,  for  then  there  must 
be  some  U  such  that  V / B,  G  U.  Assume,  by  way  of  contradiction,  that  V j B.t  is  incon¬ 
sistent.  Then  there  are  formulas  </>i, . . . ,  </>m  G  V / B,t  such  that  b  ->(<f) i  A  ...  A  (pm).  Since 
4>i  ,...,<f)n  G  V/Bj,  we  conclude  that  Bt<pi. ....  Bt(f)m  G  V.  Using  the  K45  axioms  for  Bj, 
standard  arguments  show  that  . . . ,  (f>n)  G  V,  and  hence  that  Bjf  false )  G  V,  which 

contradicts  the  consistency  of  V .  □ 

Lemma  10:  Let  M  be  a  propositional  Kripke  structure  of  knowledge  and  plausibility  satis¬ 
fying  CONS  and  SDP.  Suppose  that  w,  i,  and  a  are  such  that  the  most  plausible  worlds  in 
Vi(w)  are  exactly  those  worlds  in  ICjfw)  that  satisfy  a,  i.e.,  MP(Vi(w))  =  {w'  G  ICjfw )  : 
(. M,w ')  1=  a}.  Then  for  any  formula  <p  G  CKB  that  includes  only  the  modalities  K,  and  If  . 
( M,w )  1 =  4>  if  and  only  if  ( M,w )  |=  <f>* ,  where  <f>*  is  the  result  of  recursively  replacing  each 
subformula  of  the  form  Bjf)  in  <p  by  Kt(a  =>-  ip*). 


PROOF.  We  prove  by  induction  that  for  any  w'  G  ICjfw),  (M,w')  |=  4>  if  and  only  if 
(. M,w ')  1=  <f>* .  The  only  interesting  case  is  if  <f>  has  the  from  Bjf.  Suppose  that  (. M,w ')  j= 
Biff.  This  implies  that  ( M,w ')  |=  true  <f>' ,  i.e.,  for  all  w"  G  MPifPjfw1))  we  have 
(. M,w ")  \=  <f> .  Now  let  w"  G  JCjfw').  If  (. M,w ")  |=  -i a,  then  (. M,w ")  |=  a  =>■  (4>')*.  If 
(M,  w")  a  then,  by  definition,  w"  G  MP (Vjfw)),  and  since  we  assumed  SDP,  MP (Vjfw1))  = 
MP (fPjfw)).  Thus,  we  conclude  that  (AL,w")  |=  <f> ,  and  using  the  induction  hypothesis  we 
get  that  (. M,w ")  |=  (</)')*■  We  conclude  that  all  worlds  in  ICjfw1)  satisfy  a  =A  (0')*,,  and  thus 
(. M,w ')  \=  Kjfa  =$■  (4>')*).  Now  assume  that  ( M,w ')  \=  Kjfa  =>■  (<!>')*)■  Let  w"  be  any  world 
in  ICjfw').  Since  we  assumed  SDP,  we  have  that  MP^^io"))  =  MP  (fPjfw))  is  the  set  of 
worlds  in  ICjfw)  that  satisfy  a.  We  conclude,  using  our  induction  hypothesis,  that  all  worlds 
in  MP  (fPjfw"))  satisfy  (ff.  Hence,  (M,  w")  [=  true  — <f>' .  Since  this  is  true  for  all  w"  G  ICj{w') 
we  conclude  that  (M, «/)  |=  Bj<f> .  □ 


A. 2  Proofs  for  Section  2.8 


Theorem  11:  AX  is  a  sound  and  complete  axiomatization  for  CKC  with  respect  to  A4. 


PROOF.  Again,  we  just  describe  the  completeness  proof.  This  proof  draws  on  the  usual 
completeness  proofs  for  S5  modal  logic,  and  the  completeness  proof  for  conditional  logic 
described  in  [Fri97,FH97b]. 

We  proceed  as  follows.  If  V  is  a  set  of  formulas,  define  V / Kj  =  {</>  :  Kj<f>  G  V}  and  V/Ni  = 
{(f>  :  Nj(f)  G  V}.  We  define  a  canonical  model  Mc  =  (W,  tv,  1C i, . . . ,  ICn,  Vj, . . . ,  Vn)  as  follows: 

•  XV  —  {wy  :  V  is  a  maximal  AX-consistent  set  of  formulas} 

•  7r (wy)(p)  =  true  if  and  only  if  p  G  V 
.  IC^Hwy^uf-.V/KiQU} 
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•  Vi(wv)  =  Pl(wv4),  where 

•  W{wvA  =  {wv  :  V/Ni  C  [/}, 

•  F(wvA  =  {[^W#  :  <t>  e  ^AC}  where  [^](„Vji)  =  {wv  G  U  i  0  G  E/},  and 

•  Pl(wv,q  is  such  that  Pl(„,v,o(M(«’v,o)  ^  P1(«v,o([^](«v,o)  if  and  onl.v  if  (oV  p)  -q  ip  &V. 

We  need  to  verify  that  Mc  is  indeed  a  structure  in  AT  Using  standard  arguments  it  is  easy  to 
show  that  the  /C*  relations  are  equivalence  relations.  In  [Fri97,FH97b]  we  prove  that  Vi(wy) 
is  a  well-defined  qualitative  plausibility  space. 

Finally,  we  have  to  show  that  (Mc,  wy)  \=  <p  if  and  only  if  (p  G  V.  As  usual,  this  is  done  by 
induction  on  the  structure  of  <fi.  We  use  the  standard  argument  for  formulas  of  the  form  Ki<j) 
and  arguments  from  [Fri97,FH97b]  for  formulas  of  the  from  cp  — q  ip.  We  omit  the  details 
here.  □ 

Theorem  12:  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDP}  and  let  A 
be  the  corresponding  subset  of  {05,  C6,  Cl,  C8,  09,  CIO}.  Then  AX  A  A  is  a  sound  and 
complete  axiomatization  with  respect  to  the  structures  in  A4  satisfying  A. 


PROOF.  Yet  again,  we  focus  on  completeness.  We  obtain  completeness  in  each  case  by 
modifying  the  proof  of  Theorem  11.  We  construct  a  canonical  model  as  in  that  proof,  checking 
consistency  with  the  extended  axiom  system.  The  resulting  structure  is  in  N4  and  has  the 
property  that  ( M,wy )  |=  cp  if  and  only  if  (p  G  V.  We  just  need  to  show  that  this  structure 
also  satisfies  the  corresponding  semantic  restrictions. 

First,  we  consider  CONS  and  axiom  C9.  Assume  that  C9  is  included  as  an  axiom.  It  is 
easy  to  see  that  this  implies  that  V/Nj  C  V/Ki.  This  implies  that  IU(,„V.:,)  C  JCjfwy)  in  our 
construction. 

Now  consider  the  relationship  between  SDP  and  CIO.  Assume  that  CIO  is  included  as  an 
axiom.  We  need  to  show  that  if  wjj  G  K-i(wy),  then  Vjfwu )  =  Vi(wy).  It  is  enough  to  show 
that  <p  — q  ip  G  V  if  and  only  if  <p  — q  xp  G  U,  since  these  statements  determine  Vt  in  our 
construction.  Assume  <f>  — q  ip  G  V.  Then,  according  to  CIO,  Kjfcp  —>i  ip)  G  V,  and  thus 
<p  — q  ip  G  V/Ki.  Recall  that  wu  G  ICjfwy)  only  if  V/Ki  C  U .  We  conclude  that  <p  — q  C  G  U. 
The  other  direction  follows  from  the  fact  that  /C,-  is  symmetric  in  our  construction,  and  thus 
Wy  G  JCjfwu). 


The  desired  relationship  between  RANK,  NORM,  REF,  and  UNIF  and  the  axioms  C5, 
C6,  C7,  and  C8  is  proved  in  [Fri97,FH97b],  for  a  logic  that  does  not  mention  knowledge. 
Since  these  conditions  put  restrictions  on  Vjfw)  and  do  not  involve  knowledge,  the  proof  of 
[Fri97,FH97b]  goes  through  unchanged;  we  do  not  repeat  it  here.  □ 

Theorem  13:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK}.  The  formula 
<p  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable  in  a  Kripke 
structure  with  at  most  woriys_ 
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PROOF.  The  proof  of  this  theorem  relies  on  techniques  from  [FH96a].  We  sketch  only  the 
main  steps  here.  The  proof  is  based  on  a  standard  filtration  argument. 


Suppose  there  is  a  structure  M  and  a  world  w  in  M  such  that  ( M,w )  |=  <p.  Let  Sub+((p)  = 
Sub{4> )  U  {~^4>  '■  4>  £  Sub(<p)}.  We  say  that  V  C  Sub+(cp)  is  an  atom  if  for  each  <f>  G  Sub((f>), 
either  <p  G  V  or  -i<fr  G  V.  We  say  that  a  world  w  in  M  satisfies  an  atom  V  if  for  all  (p  G  V, 
we  have  (M,  w)  |=  <f>.  It  is  easy  to  see  that  each  world  satisfies  exactly  one  atom.  Given 
a  world  w',  we  define  [w]  to  be  the  equivalence  class  containing  all  worlds  that  satisfy  the 
same  atom  as  w.  For  each  equivalence  class  [re],  we  arbitrarily  choose  a  representative  world 
tv  G  [w].  We  define  M'  =  (W1,  it',  K!x,  . . .  KIn,  V[, . . . ,  V'n),  where  W'  =  {[ic]  :  w  G  W}, 
^'(M)  =  n(w[w]),  K'i  =  {(>;.  V)  :  (w,w')  G  K-i } ,  and  V'([w})  =  {W[[w]A,  P1'(H ,0),  where 
=  {[^']  :  w>  e  and  P1'(Hj0(A)  <  PI if  Pl(„,Hy)(A*  n  LF(„,M ;i))  < 

PI n  W(U,H ,*)),  where  A*  =  {w"  :  3[ty'J  G  A,  w"  G  [«/]}.  Arguments  essentially 
identical  to  those  of  [FH96a]  show  that  (M',  [w])  \=  ip  if  and  only  if  (. M,w )  |=  ip  for  all 
ip  G  Sub{(p );  we  omit  details  here. 


We  now  have  to  describe  how  to  modify  this  argument  to  ensure  that  M'  satisfies  A.  The 
modifications  for  NORM,  REF,  UNIF  and  RANK  are  described  in  [FH96a].  Suppose  that  M 
satisfies  CONS.  Let  [■ w ']  G  By  definition,  w'  G  IL(„;  .v,-  But  since  M  satisfies  CONS, 

we  have  that  w'  G  JCi(w[w ]).  By  definition,  we  get  that  [w'\  G  /C'([rw]).  We  conclude  that  M' 
satisfies  CONS.  Finally,  suppose  that  M  satisfies  SDP.  We  force  M'  to  satisfy  SDP  as  follows. 
For  all  worlds  w,  we  choose  a  representative  world  G  /C'([ru])  such  that  if  (w,  w')  G  K,t . 

then  ■—  (;«.■'])•  We  then  modify  the  construction  so  that,  for  each  world  v  G  JCi(w ), 

we  have  P,-([u])  =  [«]))•  R  is  easy  to  see  that  for  all  ip  — q  y  G  Sub(<p ),  we  have  that 

(. M,w )  |=  ip  — q  y  if  and  only  if  (M,  rw/cyH))  |=  ip  X ■  Thus,  it  is  easy  to  show  that 

after  this  modification  we  still  have  that  (AT,  [iy])  |=  ip  if  and  only  if  (. M,w )  |=  ip  for  all 
ip  G  Sub(<p).  □ 


Theorem  15:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK }  containing 
CONS  and  either  SDP  or  UNIF.  If  <p  talks  about  the  knowledge  and  plausibility  of  only  one 
agent,,  then  <p  is  satisfiable  in  a  Kripke  structure  satisfying  A  if  and  only  if  it  is  satisfiable 
in  a  preferential  Kripke  structure  satisfying  A  with  at  most  |Sub(</>)|3  worlds. 


PROOF.  Assume  M  =  (W,  n,  /Ci,  V\)  is  a  structure  satisfying  <p.  Since  CONS  is  in  A,  we 
must  have  that  C  K\{w)).  Without  loss  of  generality,  we  can  assume  that  K-i  consists 

of  one  equivalence  class,  that  is,  that  K\  =  W  x  W.  Since  CONS  and  SDP  imply  UNIF,  and 
since  A  contains  CONS  and  either  SDP  or  UNIF,  we  conclude  that  M  satisfies  UNIF.  Using 
techniques  from  [FH96a]  we  can  assume,  without  loss  of  generality,  that  for  each  world  w, 
the  plausibility  space  V\  (w)  is  preferential  (i.e. ,  induced  by  some  preference  ordering)  and 
that  i)  has  at  most  \Sub(cp)\2  worlds. 

Choose  w0  G  W  such  that  (M,  w0)  |=  <p.  For  each  formula  -> K^ip  G  Sub{(p )  such  that 
(M,w0)  |=  * K i  tp,  we  select  a  world  such  that  ( M,w |=  -ftp.  Let  T  be  {rc0}  U 
{w^,  :  -i Kiip  G  Sub(<p)}.  Note  that  the  cardinality  of  T  is  at  most  \Sub(<p)\.  Define  M'  = 
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{W' , 7r',  K,},  V[)  by  taking  W'  to  be  the  union  of  W'^wl)  for  each  w  G  T,  taking  it'  to  be  7r 
restricted  to  W .  and  taking  V[(w)  =  Vi (w).  Clearly  \W'\  is  at  most  \Sub(cf))\3.  A  straightfor¬ 
ward  argument  for  all  sub  formulas  if  of  <j)  and  all  worlds  w'  G  W' .  we  have  ( M ,  w')  \=  if  if  and 
only  if  }M'  ,w')  |=  'll:.  It  follows  that  ( M',w0 )  |=  <f>,  so  <ft  is  satisfiable  in  a  small  preferential 
structure.  □ 

Theorem  16:  Let  A  be  a  subset  of  {CONS,  NORM ,  REF ,  SDR.  UNIF ,  RANK}.  If  CONS  G 
A,  but  it  is  not  the  case  that  UNIF  or  SDP  is  in  A ,  then  the  validity  problem,  with  respect 
to  structures  satisfying  A  is  complete  for  exponential  time.  Otherwise,  the  validity  problem 
is  complete  for  polynomial  space. 


PROOF.  The  proof  combines  ideas  from  [FH94a,FH96a,HM92],  We  briefly  sketch  the  main 
ideas  here,  referring  the  reader  to  the  other  papers  for  details. 

The  polynomial  space  lower  bound  follows  from  the  polynomial  space  lower  bound  for  logics 
of  knowledge  alone  [HM92] .  For  the  exponential  lower  bound  we  use  exactly  the  lower  bound 
described  Fagin  and  Halpern  [FH94a]  for  the  combination  of  knowledge  and  probability 
(which  is  in  turn  based  on  the  lower  bound  for  PDL  [FL79]).  This  lower  bound  construction 
uses  only  formulas  involving  K \  and  probabilistic  statements  of  the  form  Wi((f>)  =  1  (i.e. ,  the 
probability  of  <j)  is  1).  Since  NK  has  exactly  the  same  properties  as  =  1,  the  same 

construction  applies  to  our  logic. 

In  the  cases  where  we  claim  a  polynomial  space  upper  bound,  this  is  shown  by  proving 
that  if  a  formula  (f>  is  satisfiable  at  all,  it  is  satisfiable  in  a  structure  that  looks  like  a  tree, 
with  polynomial  branching  and  depth  no  greater  than  the  depth  of  nesting  of  /C,  and  ^ ,,- 
operators  in  (f.  The  result  now  follows  along  similar  lines  to  corresponding  results  for  logics 
of  knowledge. 

Finally,  the  exponential  time  upper  bound  follows  by  showing  that  if  a  formulas  is  satisfiable 
at  all,  it  is  satisfiable  in  an  exponential  size  structure  that  can  be  constructed  in  deterministic 
exponential  time;  the  technique  is  similar  to  that  used  to  show  that  logics  of  knowledge  with 
common  knowledge  are  decidable  in  deterministic  exponential  time  [HM92]  or  that  PDL  is 
decidable  in  deterministic  exponential  time  [Pra79].  □ 

Theorem  17:  Let  A  be  a  subset  of  {CONS,  NORM,  REF,  SDP,  UNIF,  RANK }  containing 
CONS  and  either  UNIF  or  SDP.  For  the  case  of  one  agent,  the  validity  problem  in  structures 
satisfying  A  is  co-NP- complete. 


PROOF.  We  show  that  the  satisfiability  problem  is  NP-complete.  It  follows  that  the  validity 
problem  is  co-NP-complete.  The  lower  bound  is  immediate,  since  clearly  the  logic  is  at  least 
as  hard  as  propositional  logic.  For  the  upper  bound,  by  Theorem  15,  (p  is  satisfiable  in  a 
structure  satisfying  A  if  and  only  if  < \ >  is  satisfiable  in  a  structure  M  of  size  polynomial  in 
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\<p\.  We  simply  guess  a  structure  M  aud  check  that  (f>  is  satisfiable.  It  is  easy  to  show  that 
model  checking  can  be  done  in  polynomial  time  (see  [HM92,FH96a]).  □ 


A. 3  Proofs  for  Section  3.3 


Theorem  20:  The  axiom,  system  ANT  is  a  sound  and  co7nplete  axiomatization  of  CKCT 
with  respect  to  C. 


PROOF.  As  usual,  we  focus  on  completeness.  Again,  we  construct  a  canonical  interpreted 
system  J  such  that  if  <p  G  CKCT  is  consistent,  then  <p  is  satisfied  in  T.  The  outline  of  the 
proof  is  similar  to  that  of  Theorem  11. 


We  proceed  as  follows.  Let  V  be  a  maximal  AXT-consistent  set  of  formulas  in  CKCT.  We 
define  V/Q  —  {</>  :  Qf>  G  V}.  We  claim  that  V/Q  is  also  a  maximal  AXT- consistent  set. 
To  show  that  V/Q  is  maximal,  assume  that  <p  ^  V/Q.  Then  Q<f  0  V.  From  axiom  T2, 
we  have  that  Q-*f)  G  V,  and  thus,  -i <f>  G  V/Q.  This  shows  that  V/Q  is  maximal.  To  show 
that  V/Q  is  AX'  -consistent,  assume  that  there  are  formulas  0\  . . . .  on  G  V/Q  such  that 
hAxr  A  ...  A  <pn).  From  Kl,  T1  and  RT1  we  get  that  false  G  V/Q.  Thus,  O false  G  V. 
Using  T2  we  get  that  ->0 true  G  V.  Using  RT1,  however,  we  get  that  O true  G  V.  which 
contradicts  the  assumption  that  V  is  consistent.  Thus,  V/Q  is  AXT-consistent.  Finally,  we 
define  V/Qm  to  the  result  of  m  applications  of  /Q.  Repeated  applications  of  the  above 
argument  show  that  V/Qm  is  a  maximal  AXT-consistent  set  for  all  m  >  0. 

We  construct  a  canonical  interpreted  system  as  follows.  Let  T  =  (7 Z,  tt.  V\ . Vn),  where 


7 Z  =  {?’y  :  V  C  CKCT  is  a  maximal  AXT-consistent  set}  such  that 

•  ry  (m)  =  V/Qm,  and 

•  ry(m)  =  {V/Qm)/Kh 

7r (rv,  m)(p)  =  true  if  and  only  if  p  G  ?,y  (m),  and 

7 °i{rv,m)  =  (W(rv^,Pl(rv5ra^),  where 

•  VU(rvmj.0  =  {(rv,n)  :  (V/Q m)/N,  C  U/Qn  },  and 


Pl(r is  such  that  Plpvmj0 


<  PI  (r'',m,i)(Mu,m1i))  if  and  only  if  (0  V^) 


Tp  G  U/Om,  where  [<j)]trV ,m,i)  =  {{rl  ■  k)  G  W(rv^  :  o  G  U/Qk}. 


Using  the  arguments  in  the  completeness  proof  for  conditional  logic  of  [Fri97,FH97b],  we 
can  show  that  Vjfr,  m )  is  well-defined  for  all  i.  Finally,  we  have  to  show  that  (I,  rv ,  m)  \=  <f> 
if  and  only  if  (j>  G  ?,y(m).  As  usual,  this  is  done  by  induction  on  the  structure  of  <f>.  This 
is  identical  to  the  proof  in  of  Theorem  11  except  for  the  Q  modality,  which  is  handled  by 
standard  arguments.  We  omit  the  details  here.  □ 


Theorem  21:  Let  A  be  a  subset  of  {RANK,  NORM,  REF,  UNIF,  CONS,  SDP}  and  let  A 
be  the  corresponding  subset  of  {C5,  C6,  Cl,  C8,  C9,  CIO}.  Then  AXT  U  A  is  a  sound  and 
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complete  axiomatization  with  respect  to  systems  in  C  satisfying  A. 


PROOF.  Again,  we  focus  on  completeness.  We  obtain  completeness  in  each  case  by  modi¬ 
fying  the  proof  of  Theorem  20.  We  construct  a  canonical  system  as  in  that  proof,  checking 
consistency  with  the  extended  axiom  system.  The  resulting  system  has  the  property  that 
(X,  ry,m)  1=  <f  if  and  only  if  <f  E  V/Qm.  We  just  need  to  show  that  this  system  satisfies 
the  corresponding  semantic  restrictions.  The  desired  relationship  between  these  semantic 
properties  and  axioms  is  proved  in  [Fri97,FH97b]  and  the  proof  of  Theorem  12.  □ 


A. f  Proofs  for  Section  f.l 


Proposition  25:  Let  I  be  a  synchronous  system  satisfying  perfect  recall  and  PRIOR.  If  <f> 
characterizes  agent  i’s  knowledge  at  (r,  m  +  1)  with  respect  to  his  knowledge  at  (r,m),  then 
(l,r,m  +  1)  1 =  if  -*j  £  if  and  only  if  (X,  r,m )  •<  OR  A  iff)  -p  Q£. 


PROOF.  Expanding  the  definition  ^ve  g6t  thnt  [[(3) (7*777,))  —  ^ 

(r,  m),  (r',  m+ 1)  |=  </>  A^}.  Similarly,  we  get  that  +1))  =  {/•'  G  HRp  :  (r'.rn  •  1)  ~j 

(r,  m  + 1),  (r',  m  + 1)  |=  if}.  However,  since  o  characterizes  agent  /"s  knowledge  at  time  m  ■  1 
with  respect  to  his  knowledge  at  time  m,  we  get  that  (R  m  +  1)  (r,  m  +  1)  if  and  only  if 

(R  m)  (r,  m)  and  (r,  m  1 )  e>.  We  conclude  that  77([OR  A  R)]pjm))  =  ^([RR,to.+i))- 

The  lemma  now  follows  directly  from  Proposition  22.  □ 

Lemma  28:  Let  T  be  a  synchronous  static  system  satisfying  PRIOR ,  RANK ,  SDP ,  and 
perfect  recall  that  has  finite  branching.  Then  (X,  r,  m)  |=  Rp  =  RQR0  /or  all  propositional 
formulas  <f>. 


PROOF.  For  all  points  (r,  m)  in  X,  note  that  HR^p  =  U{A,,/,},  where  A^  is  the  set  of  points 
(R  m)  (r,  m)  such  that  the  agent’s  new  knowledge  at  time  m  +  1  is  if.  If  X  has  finite 
branching,  this  is  a  finite  partition  of  HR™,*) .  Additionally,  note  that  if  PR>mji)  is  a  ranking, 
and  (R . . .  Ck  is  a  finite  partition  of  C.  then  since  PR,m ,i)(C)  =  max  ]<•,<*  PI (r,m,i)(Cj),  there 
must  be  some  j  such  that  Pip =  PRmpj/C').  In  particular,  for  all  C  C  HR^,),  either 

Plp,m,i)(C)  =  T  °r  Pip ~  C)  =  T . 


For  the  “=R  part,  suppose  that  (X,  r,  m)  |=  RR.  If  Pip ,m,*)(BR,™,*))  =  -R  then  (X,  r,  m)  j= 
R( O  *P  VaCUOUSly.  If  Plp.TO,p  (  HR,m.i) )  A  X,  then  PR,m,j)([/)]p,m,j))  A  PR,m,i)(IR Rip,™,*))- 
Assume  that  if  is  such  that  PRjm,*)(R/’)  =  T.  It  is  easy  to  verify  that  since  PR,mjj)  is  a  rank¬ 
ing,  we  get  that  PR^RA^.  n  Rip,™,*))  >  PR™,*)  (A/’  n  JrRj  p,™,*))-  Let  r>  be  a  1,111  such  that 
(r',m)  G  A. By  SDP,  we  get  that  PR,rap)  =  Plpp^p  and  thus  PI p',m,o(Ay  fl  IRJp',™,*))  > 
Pip', m, «) (A^/,  n  I-R]p'im,i))-  By  definition  of  we  have  that  ( r".m  +  1)  (R  m  +  1)  if 
and  only  if  (r",m)  E  A^.  Since  X  satisfies  PRIOR,  PR',m+ip)  is  the  result  of  conditioning 


51 


Pip, m,i)  on  A *p  Moreover,  since  propositions  are  static,  we  get  that  Plp',™+i,*)  ,m+ 1  i)> 

Pl(r',m+i,*)(h#fr';,m+i,o)-  Thus,  (. l,r',m )  (=  O Erf.  We  conclude  that  4^  C  [OR</>]p,™,*), 
and  thus  Plp,™,q([O£*0j(r,™,i);)  =  T.  Moreover,  since  4^,  C  fOR^lp,™,*)  for  all  4^  such  that 
Pl(r,m,i)  (Aip )  T ,  We  get  that  Pl(r,m,i)([— '0^0]  (r, m,-!))  —  111  ax  {  P 1  p _  r rt  _ * )  (  4 */, )  .  Pip,™,*)  (4^,)  G 
T}  <  T.  We  conclude  that  Pl^,Tn,<)(|0^i^](r,m1t))  >  Pip,™,*;!!  ORcTp,™,*;)-  and  thus, 
(J,  r,  m)  |=  BiQBicf). 


For  the  “<*=”  part,  suppose  that  (X,  r,  m)  |=  BiQB If  Plp,™p  (IPp,™,*))  =  -L,  then  (X,  r,  m)  |= 
Bi4>  vacuously.  If  Plp,™,q(lkp,m,j))  7^  -L,  then  > 

pI(w)dnOS^](w)).  Thus,  since  Pip,™,*)  is  a  ranking,  Plp,™,*)([QR*<^Jp?™,*))  =  T-  Let 
(r',  m)  be  some  point  in  A$  for  some  fj.  By  SDP,  we  have  that  (X,  r',  m)  (=  O B<j>  if  and  only 
if  (X,  r",m)  |=  O  B4>  for  all  points  (r",m)  G  4^.  Thus,  [OR</>]p,™,*)  =  A^  U  ...  U  Ai<k 
for  some  $**...,$*.  Since  Pip,™,*) ([O^l )  >  pl(r,™,o(bO£*fo]p,™,*));  we  get  that 
Pl(r,m,i)(A^)  =  T  only  if  tf  =  ipj  for  some  1  <  j  <  k.  Moreover,  since  Afa#  ■  ■  ■ ,  4*p  is  a  finite 
partition  of  [Q R^Jp,™,*))  there  must  be  at  least  one  1  <  j  <  k  such  that  Pip,™,*)  (4^)  =  T. 
Let  ifij  be  such  that  Pip,™,*) (4^ )  =  T.  Suppose  that  (r',m)  G  4p..  Then  we  have  that 
Plp',»c:  i,*)( Xfoy,™ ;  i.*;)  >  Plp',™.+i,*)(h^]p',™.+i,*))-  Since  X  is  synchronous,  static,  and  sat¬ 
isfies  perfect  recall,  PRIOR,  and  SDP,  we  get  that  Pip,™,*)  (4^  O  [</>]p,™,*))  >  PI p,™,*)(4^  O 
Ih^Jp,™,*))-  Since  Pip,™,*)  is  a  ranking,  we  get  that  Pip,™,*)  (4.0 .  0  [</>]  p,™,*) )  =  T,  and  thus, 
Pip,™,*)  ([0]  p,™,*) )  T .  Finally,  if  Pip,™ ,*)  (4^,)  G  T,  then  Pip,™,*)  (4^,  0 1~ > '</>]  p,™,*|)  G  T.  Thus, 
since  Pip,™,*)  (I-1 '^Ip,™,*))  max^,  Pip,™,*)  (4,0 0  1 '</>] p,™,*) ) ,  we  get  that  Pip,™,*)  ([4 '^Jp,™,*))  G 
T.  We  conclude  that  (X,  r,  m)  \=  Bpp.  □ 


A. 5  Proofs  for  Section  f.2 


Theorem  32:  Let  A  be  a  subset  of  {QUAL,  NORM,  REF,  RANK }  and  let  X  be  a  coherent 
synchronous  system  satisfying  perfect  recall,  CONS,  and  A.  Then  there  is  a  synchronous 
system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping  f  :IZ  i— >  TV  such  that  for 
all  temporally  linear  formulas  (f>  G  jCkct ,  we  have  (X,  r,  m)  |=  <f>  if  and  only  if  (X' ,  f(r),  m )  |= 
(f. 


PROOF.  To  construct  X',  we  use  a  general  technique  for  taking  a  “sum”  of  a  sequence 
of  plausibility  spaces.  Let  A  be  an  ordinal  and  let  {Si  :  0  <  i  <  A}  be  a  sequence  of 
plausibility  spaces,  where  Si  =  (kF*,Pl*)  and  the  kk*’s  are  pairwise  disjoint.  Define  ©jR*  as 
(U;ir,,PL.s, ).  where  PI ©Si(4)  >  Pl^(R)  if  either  PI, (4  D  IF,)  =  PI, (/I  D  IP,)  =  ±  for 
all  i,  or  there  exists  some  i  such  that  PI, (4  fl  kF*)  >  P1,(R  fl  IP*),  Pl*(4  fl  kF*)  >T,  and 
PI,  (4  0  kP,-)  =  Plj(R  fl  kPj)  =  T  for  all  j  <  i.  We  can  think  of  ©jS1*  as  a  lexicographic 
combination  of  the  Sf  s. 

Lemma  35  (a)  ©jS1*  is  a  plausibility  space, 

(b)  if  Si  is  qualitative  for  alii,  then  ©jR*  is  qualitative, 

(c)  if  Si  is  ranked  for  all  i,  then  ©jS1*  is  ranked, 
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(d)  f0j<S,;)|c<  is  isomorphic  to  (Bi(Sj  ()  under  the  identity  mapping. 

(e)  ((EySj)  iij  is  isomorphic  to  Sj  under  the  identity  mapping. 

(f)  IfWj, . . . ,  Wk  =  0,  then  ©jR*  is  isomorphic  to  (Bi>k+iSi. 


PROOF.  We  have  to  show  that  <  is  reflexive,  transitive,  and  satisfies  Al.  It  is  easy  to  see 
that,  by  definition,  <  is  reflexive.  Next,  we  consider  transitivity.  Suppose  that  P^g^A)  > 
FFg.lR)  and  Pl,r.s,(/^)  >  PI  ®s*(C).  If  Ph(BPW;)  =  T*  for  all  i,  then  clearly  Pl(Cn  Wj)  =  L* 
for  all  i  (since  PI 0gt(R)  >  Pfes^C)},  so  Pl0g,(A)  >  Pl0gt(C).  So  suppose  that  PI (RnW*)  > 
_L*  for  some  i.  Let  i  and  j  be  the  smallest  indexes  such  that  PI,: (A  fl  Wj)  >  _L *  and  PI j(B  fl 
Wj)  >  ±j.  It  is  easy  to  see  that  i  <  j,  and  that  Plfc(C  fl  Wk)  =  Xk  for  all  k  <  j.  If  i  <  j,  we 
conclude  that  PI*  (An  Wj)  >  PI*  ((7  fl  Wj)  =  _L*,  and  thus  PJ^gj(A)  >  PI^gj(C').  On  the  other 
hand,  if  i  =  j,  then  by  definition  Pl,(An  IP()  >  Plt(B  n  Wj),  and  VUBnW)  >  PldOfAl;). 
Since  <  is  transitive  in  Sj,  we  get  that  P1,;(A  fl  Wj)  >  P1,(C'  fl  Wj).  Thus,  we  conclude 
that  P^g^A)  >  P^g^C),  as  desired.  Finally,  we  consider  Al.  Suppose  that  A  C  B.  Then 
ADWj  C  BdWj  for  all  i.  Since  each  Sj  satisfies  Al,  we  have  that  Plj(AntTj)  <  PI* (O' HIT*) 
for  all  i.  It  easily  follows  that  Pl^(A)  < 

Suppose  that  Sj  is  qualitative  for  all  i.  We  have  to  show  that  ©*£>'*  is  also  qualitative.  We 
start  by  considering  A2.  Suppose  that  A,  B ,  and  C  are  pairwise  disjoint  sets  such  that 
1  ’1,  s,  (A  UR)  >  Pl0gi(C')  and  P10$*(A  Ud)  >  Pl^^R).  Let  i  and  j  be  the  minimal  indexes 
such  that  P1*((A  U  B)  fl  Wj)  >  _L*  and  Plj((A  U  C)  fl  Wj)  >  _Lj.  We  claim  that  i  =  j. 
Assume,  by  way  of  contradiction,  that  i  <  j.  Then,  P1*((A  U  C)  fl  Wj)  =  _L*  and  hence 
P 1*  (A  fl  Wj)  =  _L*.  Moreover,  since  Pl^g^A  Ud)  >  Plfgs^R),  we  get  that  P1*(R  fl  Wj)  =  _L*. 
Using  A3  in  S'*,  we  conclude  that  P1*((A  U  B)  fl  IU* )  =  _L*,  which  contradicts  our  assumption 
that  P1*((A  U£)fl  Wj)  >  _L*.  Symmetric  arguments  show  that  we  also  cannot  have  j  <  i. 
Thus,  i=j.  By  definition  PI* ((AuR)nLU*)  >  Pl*(CrW*)  and  Pl*((AuC')nW*)  >  Pl*(RrW*). 
Using  A2  we  conclude  that  P1*(A  fl  Wj)  >  P1*((R  U  C)  fl  Wj).  It  is  also  easy  to  verify,  using 
A3,  that  Plj((£>  Ud)fl  Wj)  =  T j  for  all  j  <  i.  Thus,  we  get  that  PL-.g^A)  >  P^g^R  U  C), 
as  desired.  Next,  consider  A3.  The  construction  of  ©S,;  is  such  that  Pl0g,(A)  =T  if  and  only 
if  Pli(A  fl  Wj)  =J_  for  all  i.  It  is  easy  to  see  that  A3  follows  from  A3  in  each  S*. 

Finally,  part  (c)  follows  immediately  from  the  definition,  part  (d)  follows  immediately  from 
COND,  part  (e)  is  a  special  case  of  part  (d),  and  part  (f)  follows  immediately  from  the 
definition.  □ 


Returning  to  the  proof  of  Theorem  32,  first  suppose  that  REF  is  not  in  A.  Let  J  = 
(71, 7T,  Vi, . . . ,  Vn)  be  a  coherent  synchronous  system  satisfying  perfect  recall  and  CONS. 
Roughly  speaking,  the  proof  goes  as  follows.  We  construct  a  system  X'  which  consists  of 
countably  many  copies  of  71.  The  runs  in  7 Zm,  the  mth  copy  of  7Z,  are  used  to  simulate  the 
agent’s  plausibility  assessment  at  time  m.  More  precisely,  for  all  times  m,  we  define  a  prior 
on  7 Zm  that  corresponds  to  the  agent’s  plausibility  measure  at  time  m  in  X.  These  priors 
are  then  combined  using  ©  to  construct  the  agent’s  prior  in  X' .  Since  ©  orders  the  priors 
lexicographically,  if  m  <  m' ,  the  priors  on  7 Zm  dominate  those  on  7 Zm  .  The  construction 
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guarantees  that  at  time  m,  the  agent  considers  possible  only  runs  in  IZm  UlZmJrl  U  . . ..  Since 
the  prior  on  IZm  dominates  the  rest,  the  agent’s  plausibility  measure  at  time  m  is  similar 
to  that  at  time  m  in  X.  This  similarity  is  what  guarantees  that  conditional  formulas  are 
evaluated  in  the  same  way  in  X  and  X' .  This  “peeling  away”  of  copies  of  IZ  ensures  that  all 
temporally  linear  formulas  holding  in  runs  in  X  are  also  satisfied  in  the  corresponding  runs 
in  X' . 


The  formal  construction  proceeds  as  follows.  Let  R  X  IZ  and  l  G  IN*  (recall  that  IN*  = 
IN  U  {oo}).  Define  R 1  =  {rl  :  r  G  R },  where,  for  each  i  G  {e.  1 . n},  we  have 


|  ( ) 
{ { rS),™, ) 


if  l  >m 
if  l  <  m. 


Let  X1  =  (IZ',  7r',  V'lit  ■  ■ ,  Vn),  where  XZI  =  VJielN*IZl,  7r'  is  defined  so  that  if  m  <  l  then 
7T \rl,m)  =  7i (r,m)  and  if  m  >  l  then  Tr(rl,m )  =  7 r(r,  Z),  and  V\  is  defined  by  the  priors 
described  below. 


To  define  a  prior  on  I Z',  we  first  define  a  plausibility  space  on  IZm  for  each  m  G  IN,  run 

to  be  isomorphic  to  Vt  (r.  m) . 


ym 

(r,i) 


r  G  IZ,  and  agent  i.  We  want  the  time  m  projection  of 

To  achieve  this,  we  define  =  (7^^),  PI ™^),  where  and  Pl™,^  is 

defined  so  that  for  A  C  we  have  P\™^((7Z(A))m)  =  Pl^,,,^^/!).  For  l  G  IN*,  we 

define  the  prior  of  agent  i  at  run  rl  to  be  the  combination  of  these  priors  for  all  time  points: 
V  ,  — 

r  Irl  ,n  — 


('•*  ,*) 


'mr  (r,i)  ‘ 


It  is  easy  to  see  that  X’  is  synchronous.  It  is  also  easy  to  check  that  T  satisfies  perfect  recall: 
From  the  definition,  we  have  that 


,  {(r"',m)  :  (r'.m)  G  /Cj(r,  m),V  >  m}  if  l  >  m 

K.{r,m)=l 

y  {(rn,  m )  :  (r',  l )  G  JCj{r,  l )}  if  l  <  m. 

Moreover,  since  X  satisfies  perfect  recall,  we  have  that  7Z()Ci(r,m  +  1))  C  IZ{lCi{r,m)).  We 
conclude  that  IZ' {Kl^r1  ,m  +  1))  C  IZ' {K'^r1 ,  m)),  which  is  just  what  we  need  for  perfect 
recall. 

Let  (j)  G  CKC  (so  that  cf>  does  not  include  any  temporal  modalities)  and  l  >  m.  We  show 
that  (X' ,rl ,m)  (=  4>  if  and  only  if  ( X,r,m )  |=  (f>.  As  usual  we  prove  this  by  induction  on  the 
structure  of  </>.  The  only  interesting  cases  are  these  that  directly  involve  modalities. 

We  start  with  the  Kt  modality.  Suppose  that  ( X,r,m )  |=  Ki<f>.  Then  for  all  points  ( s,m )  G 
/Cj(r,  m),  we  have  ( X ,  s,  m)  |=  <fr.  Let  ( sk ,  m)  G  /C'(rz,  m).  From  the  definition  of  X'  we  get  that 
( s,m )  G  K,j(r,m )  and  k  >  m.  Using  the  induction  hypothesis,  we  get  that  ( X',sk,m )  |=  c[). 
We  conclude  that  (X' ,  rl,  m )  |=  K,,(p.  Now  suppose  that  ( X ,  r,  m )  K \(j).  Then  there  is  a  point 
(s,  m)  G  K,{r,  m)  such  that  ( X ,  s,  m)  \=  -*j).  Using  the  induction  hypothesis  we  conclude  that 
( X,sm,m )  1=  -i 4>.  Since  ( sm,m )  G  /C'(rz,m),  we  conclude  that  (X' ,rl,m)  K^. 
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We  now  turn  to  the  — q  modality.  The  definition  of  PRIOR  implies  that  V[ (V .  rn)  is  the 
projection  of  V'^i  ^  conditioned  on  7Zr ()Ci(r\m)).  Now  V'^i  =  ©mPl™,^.  Parts  (d)  and 
(f)  of  Lemma  35  imply  that  V{ri  ,:)|  w (jc\rl ,m))  is  isomorphic  to  Qk>in{V(r  i) )  )•  Con¬ 


sider  the  first  term  in  the  “sum" ,  V, 


(rJ) 


Since  1  satisfies  CONS,  we  have  that 


W(r.m,i)  X  /Cj(r,  m).  Thus,  conditioning  on  TZ1  (K-pr.  rn))  does  not  remove  any  runs  from 

■  It  follows  that  T’(™pk'(K:'(rym)j  =  which  is  isomorphic  to  Vi(r,m) 
under  the  mapping  r'm  i— >•  ( r',m ).  Finally,  since  is  the  first  plausibility  space  in  the 
“sum" ,  it  determines  the  ordering  of  all  pairs  of  sets,  unless  both  of  them  are  assigned  plau¬ 
sibility  _L  by  Plp,p-  Putting  all  this  together,  we  conclude  that  if  A! ,  B'  C  W\ri  rn  ^  and 
A,B  C  such  that  ( 1Z(A))m  =  TZ'(A')  O  7 Zm  and  (7 Z(B))m  =  TZ'(B')  O  7Zm,  and  if 

Pl(r, m,i) (A)  >  1,  then  PI {ri,m,i)(A')  >  P l[rKm,i)lB')  if  and  only  if  Pl(r,m,»)(A)  >  Pl(r,TO,p(S). 


Assume  that  ( l,r,m )  |=  o  -»i  ip.  Thus,  either  PI (r,m,i)(Mtr1mJi))  =  -1  or  p Wvod'M 
ip]{r,m,i))  >  P l(r,m,*) ( [</>  A  ~11P\ {r,m,i) ) •  If  Pl(r,m^(W (nm© )  =  -4  then  from  the  coherence  of  1  it 
follows  that  if  A  C  W(rjz',i)  and  7Z(A)  C  then  Pl(r,z',t)(-T)  =  _L.  This  implies  that 

Pb,i)((K(I^]cw.i))r  MHWW)?')  =  X  for  all  l'  >  m.  Since  IC'jprKm)  contains  only  points 
from  7 V  for  l'  >  m ,  we  get  that  Pl(P!mjp([</>](r!,m,i))  =  T.  Thus,  we  conclude  that  (T ,  rl,  m )  |= 
<P  ->i  ip  in  this  case.  Now  suppose  that  P1,:>,„M!(>  A  ipjx,m.j))  >  Pl(r,m,o("o  A  -np}(r, «,»))■  If 
we  could  show  that  (74[</>](7-,m,*)))m  =  'B! {\_<P\{rl,m,i))  C  72.m,  and  similarly  for  ip,  then  we 
could  apply  the  argument  of  the  previous  paragraph  to  show  that  Plpy^pd^  A  > 

Pl(ri,m,i)([^A_'^](r!)m)i)).  This,  in  turn,  would  allow  us  to  conclude  that  (X' ,  rl,  m)  \=  <p  — q  ip. 
The  fact  that  (74[0](r-,m,i)))m  =  7 H  XZm  follows  from  the  following  chain  of 
equivalences: 


S™  G  (7?.([0J 
iff  (s,m)  G  {(Pl(r,m,i) 
iff  (s,  m)  G  VP(r,mji)  and  (I,  s,  m)  \=  <p 

iff  sm  G  (Jl(W(r,Tn,i)))m  =  TZ(r.i)  and  (by  the  induction  hypothesis)  (l1  4  <P 

iff  (sm,  m)  G  and  (T.  sm,rn)  \=  <p 

iff  (.s"‘.  w)  G  »(,y„a) 

iff  «"*  G  'R.{P&  (rizinti))  C  W". 


Thus,  in  either  case,  we  conclude  that  (l1  ,rl,m)  |=  (p  — q  ip,  as  desired. 


For  the  converse,  suppose  that  (I,  r,m )  ^  <p 
PI(r,m,i)  ([^  A  1p\  (r,m,i)  )  P^  PI(r,m,i)  (  \4*  A  '1p\  (r,m,i) , 
that  Pl'(?.ijmjOd0  A  d](P,m,o)  >  X  and  P1(r*,m,i) 


i  ip-  Then  P4-,m,p  >  J-  and 

).  By  the  same  arguments  as  above,  we  get 
([0  A  b’]  (rfim,*))  P^  PI(rJ,m,i)  (1*^  A  l'0]  )  < 


Thus,  (l',rl,m)  4  4>  - h  4  as  desired. 


Finally,  for  r  G  7 Z,  define  f(r)  =  r°°.  We  have  proved  that  if  <p  G  CKC ,  then  (. I,r,m )  4  4> 
if  and  only  if  ( X' ,  f(r),m )  \=  <p.  Since  this  holds  for  all  m,  a  straightforward  argument 
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by  induction  on  structure  shows  that  this  holds,  not  just  for  formulas  in  CKC ,  but  for  all 
temporally  linear  formulas. 

We  now  have  to  ensure  that  X'  satisfies  A.  Suppose  that  X  satisfies  QUAL.  Thus,  Vi(r,m) 
is  qualitative  for  all  agents  i,  runs  r  G  R,  and  times  m.  Using  part  (b)  of  Lemma  35,  we 
conclude  that  the  prior  is  qualitative  for  all  agents  i  and  runs  r  G  R.  This  implies, 
using  Proposition  29,  that  X'  satisfies  QUAL.  Similarly,  if  X  satisfies  RANK,  using  part  (c) 
of  Lemma  35  and  Proposition  29,  we  get  that  X'  satisfies  RANK. 

Suppose  that  X  satisfies  NORM.  Then  Ay..my{\t,ru(i\  >  T  for  all  agents  i,  runs  r  G  XZ,  and 
times  m.  This  implies  that  -t (true  — q  false )  is  valid  in  X.  Suppose  that  l  >  m.  Then  since 
-i (true  — q  false )  G  CKC .  we  conclude  from  the  proof  above  that  ( X',rl,m )  |=  -> (true  — q 
false).  Thus,  PI [rl  ,m,i)(Uruei(rl  ,m,i))  >  -L.  Suppose  that  l  <  m.  By  definition,  we  have  that 
7 Z' (JCj(rl ,  m))  =  (7 Z(ICi(r,l)))1 .  Using  part  (e)  of  Lemma  35,  we  get  that  V[ri^\ n' (K'\rl ,m))  is 
isomorphic  to  Vl(r  .  However,  the  latter  plausibility  space  is  isomorphic  to  Vfr.  1).  Thus,  it 
satisfies  T  >  _L.  We  conclude  that  X'  satisfies  NORM,  as  desired. 

Up  to  now  we  have  assumed  that  REF  is  not  in  A.  If  REF  is  in  A.  then  REF  does  not  hold  for 
A,  although  it  does  hold  at  many  points.  To  understand  the  issue,  suppose  that  REF  holds 
in  X.  Since  X'  satisfies  PRIOR,  to  show  that  REF  holds  in  X' .  according  to  Proposition  29 
it  suffices  to  show  that  all  priors  satisfy  REF.  This  is  indeed  the  case  if  l  A  oo.  For  suppose 
that  rl  G  A  C  7 Z' .  We  want  to  show  that  Pl(ff ^(A)  >  _L.  Recall  that  V'^i  =  jbwTT"©.  From 
the  definition  of  ©,  it  easily  follows  that  if  Pl^^fW  0  1Zl)  >  _L,  then  Pl^rt^(A)  >  T.  By 
definition,  we  have  that  Pl^  ^{A  0  7Zl)  =  Pl(r-,/!,i) (m7) ,  where  A'  =  {(s,l)  :  s 1  G  A}.  Clearly 
(r, /)  G  A',  since  { rl,m )  G  A.  Since  X  satisfies  REF,  we  must  have  that  Plpj^A')  >  _L.  It 
follows  that  Pl^-i^j)  satisfies  REF  if  l  A  oo.  This  argument  breaks  down  if  l  =  oo.  Indeed,  it 
is  clear  that  V'^  ^  does  not  satisfy  REF.  Since  7Z°°  is  disjoint  from  7 Zm  for  m  <  oo,  and  we 
only  “sum”  for  m  <  oo  to  obtain  V^raa  it  follows  that  7Z°°  is  disjoint  from  W'^r00  y.  so 
REF  does  not  hold. 


Fortunately,  a  slight  modification  of  the  construction  of  X'  can  be  used  to  deal  with  the  case 

. ploS>) ) ’  where  =  and  >  x-  Modify 


REF  6  A.  Define  P”,,  =  (R^ 


the  construction  of  Xr  so  that  the  prior  of  agent  i  in  run  r  is  V"ri  ^  —  V[ri  iY  (Thus 


(AS 


( rl,i )■ 


V'/'i  =  ®m<ocP7fi  ,v)  P  is  easy  to  check  that  X'  now  does  satisfy  REF.  The  argument  in  the 

case  that  l  ^  oo  remains  unchanged.  On  the  other  hand,  if  r°°  G  A  C  7Z ,  it  is  immediate 
that  V°°(A  fl  7Z°°)  >  _L,  so  we  can  now  deal  with  this  case  as  well.  If  QUAL,  RANK,  or 
NORM  is  in  A,  it  is  easy  to  see  (using  the  same  argument  as  above)  that  X 1  also  satisfies 
QUAL,  RANK,  or  NORM. 


It  remains  to  show  that  this  modification  of  the  prior  does  not  affect  the  evaluation  of 
formulas.  That  is,  we  must  show  that  ( X,r,m )  |=  (f>  if  and  only  if  ( X',rl,m )  |=  <f>  for  all 
l  >  m.  Again,  we  proceed  by  induction  on  the  structure  of  formulas.  The  argument  for 
formulas  of  the  form  Kt(p  goes  through  unchanged,  since  the  changes  to  IT  did  not  affect 
the  TCj  relations.  The  argument  for  formulas  of  the  form  cf>  — q  if  goes  through  with  almost 
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no  change.  The  only  case  that  requires  attention  is  if  ( T,r,m )  (=  <fi  — q  ip  and  =  -L. 

Our  earlier  arguments  showed  that  PI {r.i)((IZ({(p](r,m,i))1'  OlZ(\ Up,/'©))^)  =  -L  for  all  l'  >  m, 
l'  A  oo.  These  arguments  go  through  without  change.  We  must  now  show  that  this  also  holds 
if  l'  —  oo.  But,  from  the  definition  of  Pl°°,  we  get  that  Pl^p^T^M^m©)00  0  77°°)  =  T 
unless  r°°  G  T^(l(p](r,m,i))00 ■  This  implies  that  (r,  m)  G  [</>J (r,m,o  •  But  this  cannot  happen, 
since  Pl(r,m,*)(M(r,m,o)  =  T  and  %  satisfies  REF.  □ 


Theorem  34:  Let  A  be  a  subset  of  { QUAL ,  NORM ,  REF,  SDP,  UNIF,  RANK }  and  let  X 
be  a  coherent  synchronous  system  satisfying  perfect  recall,  CONS,  PERSIST,  and  A.  Then 
there  is  a  synchronous  system  X'  satisfying  perfect  recall,  PRIOR,  and  A,  and  a  mapping 
f  :  1Z  i— >•  1Z'  such  that  for  all  temporally  linear  formulas  <p  G  CKCT ,  (X,  r,  m )  | =  (p  if  and  only 
if  (Z',f(r),m)  |=  4>. 


PROOF.  Suppose  that  X  =  (1Z,  7r,  Vi,  . . . ,  Vn)  is  a  coherent  synchronous  system  satisfy¬ 
ing  perfect  recall,  CONS,  PERSIST,  and  A.  If  neither  CONS  nor  UNIF  are  in  A,  then 
Theorem  32  guarantees  that  there  is  a  system  X'  that  satisfies  the  stated  properties. 

Suppose  that  UNIF  G  A,  but  SDP,  REF  f  A.  (We  sketch  the  modifications  required  to 
deal  with  SDP  and  REF  below.)  It  does  not  follow  that  the  system  J'  constructed  in  the 
proof  satisfies  UNIF.  To  see  why,  suppose  r,  r'  and  m  >  k  are  such  that  ( r ' ,  k )  G  but 

(r,  m)  Ai  ( r',m ).  UNIF  implies  that  Vjfr,k )  =  Vi(r',k)  and  (since  X  also  satisfies  CONS) 
that  =  0-  Hence,  our  construction  guarantees  that  V'yk  y  A  ' P(r,fc  ,:)>  although 

r'k  G  W(rk  tj-  Thus,  the  prior  in  X'  does  not  satisfy  UNIF.  It  follows  that  X'  does  not  satisfy 
UNIF  either,  for  V[{rk ,  k )  A  P) (j'k ,  k),  although  ( r'k ,  k)  G  IU(rfc  k  iy 

The  solution  to  this  problem  is  relatively  straightforward.  We  modify  our  construction  so 
that  the  prior  does  indeed  satisfy  UNIF.  In  particular,  we  modify  the  prior  V'  to  ensure  that 
if  Vi(r,  k)  =  Vi{r' ,  k),  then  P'rfc  y  =  P'r,k  ky  Of  course,  we  have  to  do  so  carefully,  so  as  to 
make  sure  that  nothing  goes  wrong  with  tfie  rest  of  the  argument  in  Theorem  32. 

We  start  with  a  modification  of  the  construction  of  ©  that  takes  sets  (rather  than  sequences) 
of  plausibility  spaces  and  returns  a  new  plausibility  space. 

Lemma  36  Let  S  be  a  set  of  plausibility  spaces  such  that  the  sets  { W  :  ( ID.  PI)  G  5}  are 
pairwise  disjoint.  Then  there  is  a  plausibility  space  ©<S  such  that 

(a)  if  S  =  (W,  PI)  G  S ,  then  is  isomorphic  to  S  under  the  identity  mapping, 

(b)  if  S  is  qualitative  for  all  S  G  S,  then  is  qualitative, 

(c)  if  S  is  ranked  for  all  S  G  S.  then  ®<5  is  ranked. 
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PROOF.  Without  loss  of  generality  there  is  an  ordinal  A  and  a  sequence  {Si  :  0  <  i  <  A} 
such  that  Si  G  S  for  all  z,  and  for  all  S  G  S,  exists  an  z  such  that  S  =  S'*.1'  Dehne 
=  (BiSi.  Part  (a)  of  Lemma  35  guarantees  that  ®<S  is  a  plausibility  space.  Parts  (a),  (b), 
and  (c)  follow  immediately  from  parts  (e),  (b),  and  (c)  of  Lemma  35,  respectively.  □ 


Recall  that  to  satisfy  UNIF  and  PRIOR,  it  suffices  to  find  a  partition  of  R  such  that  all 
the  runs  in  each  cell  have  the  same  prior.  We  now  examine  a  possible  way  of  partitioning 
the  runs  in  the  system.  Let  r  G  R.  Define  [r,  m]*  =  {(r',m)  :  (r',m)  (r,m),Vi(r' ,m)  = 

Vi(r ,  m)}.  Thus,  [r,  m],  is  the  set  of  points  in  which  agent  i  has  the  same  knowledge  state  and 
plausibility  assessment  as  at  (r,  m).  (Note  that  if  Wp,™,*)  0;  then  since  I  satisfies  CONS, 

Vi(r',m)  =  Vi(r,m )  implies  that  ( r',m )  ( r,m ).) 

Lemma  37(a)  For  all  times  m,  the  collection  {7 Z([r,m\i)  :  r  G  71}  is  a  partition  of  71. 

(b)  For  all  times  m  and  runs  r,  bL(r,m,0  Q  [r,  m]*. 

(c)  For  all  times  m  and  runs  r,  7 Z([r,m  +  1]*)  C  7 7([r,  m]*). 

(d)  For  all  times  m  and  runs  r,  r'  such  that  (r',0)  G  [r,  0]j,  if  (rfm)  (r,m),  then  (rfm)  G 

[r,  m]i. 


PROOF.  By  definition,  if  ( r',m )  G  [r,  ra]*,  then  [r',  m]  =  [r,  ra]*.  Thus,  if  [r,  m]*  ^  [r',m]j, 
then  [r,m]i  O  [ r',m]j  =  0.  Part  (a)  follows  immediately.  For  part  (b),  suppose  that  ( r',m )  G 
I V(r,m,i).  Since  X  satisfies  CONS,  we  have  that  ( r\m )  ~ ,  ( r,m ).  Moreover,  since  X  satisfies 
UNIF,  we  have  that  Vjfr1 ,  m)  =  Vi(r,  m).  Thus,  (r',  m)  G  [r,  m]j.  We  conclude  that  IU(rv„t:i)  C 
[r,m\i,  as  desired.  For  part  (c),  suppose  that  (r',m+  1)  G  [r,  m  +  1]*.  This  implies  that 
(r',  m+ 1)  (r,  m  + 1)  and  m  + 1)  =  Vjfr,  m  + 1).  Since  X  satishes  perfect  recall,  we  get 

that  (r',  m )  (r,  m).  Moreover,  since  X  satisfies  PERSIST,  we  get  that  Vi(r' ,  m)  =  7- ffr,  m ). 

We  conclude  that  ( r',m )  G  [r,  m]  j.  Thus,  7?.([r,  m  +  1]*)  C  7l([r,  m],),  as  desired.  Finally,  we 
prove  part  (d)  by  induction  on  m.  When  m  =  0,  part  (d)  obviously  holds.  Suppose  that 
m  >  0,  (r',0)  G  [r,  0],;,  and  (r',m)  ^  (r,  m).  Since  X  satisfies  perfect  recall,  we  have  that 
(r',  m  —  1)  (r,  m  —  1).  Using  the  induction  hypothesis,  we  get  that  (r',  m  —  1)  G  [r,  m  —  1]. 

This  implies  that  Vjfr1,  m  —  1)  =  Vi(r,  m  —  1).  Using  PERSIST,  we  conclude  that  Vi(r' ,  m)  = 
Vi(r,m).  Thus,  ( rfm )  G  [r,  m\iy  as  desired.  □ 


Using  both  ©  and  ®,  we  now  construct  a  prior  over  TV  that  satishes  UNIF.  For  r  G  R ,  let 
[r}i  abbreviate  7?.(  r.  ()(,).  Dehne  TJf).  =  ?s{V"f  v  :  r'  G  [r],;},  where  =  (7<1!','^:.  Pl!"0) 

is  the  prior  dehned  in  the  proof  of  Theorem  32  that  is  isomorphic  to  Vi(r,m)  under  the 
mapping  r'm  ( r',m ).  We  must  show  that  is  well  dehned;  that  is,  we  must  show  that 


©  vm  Vm 

11  '  ( r',i )  T  r  (r",j)s 


then  71™,  ^ 


(r,i) 

is  disjoint  from  Tiff, 


Note  that  if  m)  G 


\r",  ml 


then 


P™,  .)  and  Vpj,  are  identical.  Using  part  (b)  of  Lemma  37  we  get  that  if  m) 


I r",  m ] 


17  If  S  is  uncountable,  this  construction  may  require  the  axiom  of  choice.  There  is  a  variant  of  the 
construction  that  does  not  require  the  axiom  of  choice,  but  the  additional  complexities  involved  do 
not  seem  worth  the  trouble. 
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then  77™,  .j  077™,,  ^  =  0,  as  desired.  Thus,  7^™.  is  indeed  well  defined.  We  now  define  V'{ri  4)  = 
©m^pt  as  the  prior  of  agent  i  in  run  rl. 

We  claim  that  this  family  of  priors  satisfies  UNIF.  Notice  that  W[ri  ,(j  =  If 

r,m  G  W(rl  then,  by  definition,  r'  G  Using  parts  (a)  and  (b)  of  Lemma  37,  we  get 

that  r1  G  [r]j.  It  easily  follows  that  [r']i  =  [?’],,,  so  indeed  the  construction  guarantees  that 
V(ri  i}  =  P(r,m  i),  as  desired.  Since  the  family  of  priors  satisfies  UNIF,  so  does  X' . 

Let  <j)  G  £AC  and  l  >  m.  As  in  the  proof  of  Theorem  32,  we  now  proceed  by  induction  on 
the  structure  of  formulas  to  show  that  ( l',rl,m )  |=  <j>  if  and  only  if  (X,  r.  m)  |=  <f>.  The  only 
difference  arises  in  dealing  with  the  — q  modality. 


As  before,  parts  (d)  and  (f)  of  Lemma  35  imply  that  V'^i  .^In1  ,m))  is  isomorphic  to 

\n'(ic'(rl,m)))-  Again,  we  consider  the  first  term  in  the  “sum",  7^™. \n'(jC(rl,m))-  We 
want  to  show  that  V^.\ w Reca11  tliat  is  the  first 

term  in  the  analogous  “sum”  in  the  proof  of  Theorem  32.  Thus,  even  though  we  are  using 
a  different  prior  from  that  of  the  proof  of  Theorem  32,  after  conditioning,  they  are  essen¬ 
tially  the  same.  By  Lemma  36,  we  have  that  7^™. \n™  ^  =  T^™*)-  Thus,  it  suffices  to  show 


that  Ur'C .j  fl  7 7'(/C'(?J,  m))  =  7 7™  •)  O  7 7'(/C'(rJ,  m ).  The  inclusion  from  right  to  left  is 
immediate.  For  the  opposite  inclusion,  suppose  that  s™  G  Ur/f:y,77™,  ^  n77'(/C'(rJ,  m)).  Since 
s™  G  7 7/(/C'(rz,  m)),  we  must  have  (r,  m)  (s,m).  Since  s™  G  lyc.;,p77™, there  must  also 
be  some  run  r'  G  [?’],,  such  that  s  G  77™,  Since  s  G  (7’/,  we  have  that  (s,  m)  G  Wp/,™,*)- 
By  part  (b)  of  Lemma  37,  (s,m)  G  j By  part  (c)  of  Lemma  37,  we  get  that  (s,0)  G 
[r',0],.  Since  (?’/,0)  G  [r,  0]j,  it  immediately  follows  that  [r',0]*  =  [r,  0],.  Hence,  (s,0)  G  [r,  0]*. 
Now  by  part  (d)  of  Lemma  37,  we  get  that  ( s,m )  G  [r, ra]*.  Thus,  Vj(s,m )  =  77,(r,  m). 
Since  X  satisfies  UNIF  and  (s,m)  G  Wp/jTOjj),  it  follows  that  Vj(s,m )  =  Vi(r',m).  Hence, 
(s,m)  G  Finally,  we  can  conclude  that  s  G  77™,.),  as  desired.  Given  this  equivalence, 

we  can  deal  with  the  — q  case  just  as  we  did  in  the  proof  of  Theorem  32. 


Finally,  we  need  to  ensure  that  X'  satisfies  A.  The  proof  of  Theorem  32  shows  that  if  X 
satisfies  NORM,  then  so  does  X' .  Using  parts  (b)  and  (c)  of  Lemma  36,  it  easily  follows  that 
if  X  satisfies  QUAL  or  RANK,  then  so  does  X' . 


If  REF  and  UNIF  are  both  in  A  (but  SDP  is  not),  then  we  need  a  further  modification  of 
the  prior,  in  the  same  spirit  of  that  in  the  proof  of  Theorem  32.  Define  V^.  =  ([r]°°,  Plpj.), 
where  Pl[p.(0)  =  T  and  Plj*j.(A)  =  T  for  all  d^0.  We  now  take  the  prior  of  the  agent  to  be 
V”ri  •)  =  Rp;  •)  ©  V^..  It  is  straightforward  to  show  that  the  resulting  system  satisfies  REF 
and  the  requirements  of  the  theorem,  using  essentially  the  same  arguments  for  dealing  with 
REF  as  in  the  proof  of  Theorem  32. 


Finally,  suppose  SDP  G  A  but  REF  is  not.  Note  that,  since  CONS  and  SDP  imply  UNIF, 
X  satisfies  UNIF,  so  we  can  assume  without  loss  of  generality  that  UNIF  is  also  in  A.  To 
get  X'  to  satisfy  SDP,  we  further  modify  V  so  that  it  depends  only  on  the  agent,  and  not 
the  run.  Thus,  we  define  V\n  =  ©{T^™.  :  r  G  77},  and  define  V'{ri =  ®mPT-  Clearly, 
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with  this  prior,  X'  satisfies  SDP.  Again,  we  need  to  check  that  this  change  in  prior  does 
not  affect  the  rest  of  our  argument.  Once  more,  the  only  difficulty  comes  in  dealing  with 
the  — case.  Just  as  in  the  case  of  UNIF,  we  proceed  by  showing  that  V™\ K'jcjr1,™))  = 
V™ i)\n'(K'.(rl,m))-  The  argument  is  actually  even  easier  than  that  for  UNIF:  We  show  that 
UrilZ™,  ^  n  7^(/C'(rz,m))  =  0  7 U(/C'(?J,m).  Again,  the  inclusion  from  right  to  left  is 

immediate.  For  the  opposite  inclusion,  suppose  that  sm  G  Ur/72.™,  ^  0  7 m)).  Since 
sm  G  TV (JCjir1 ,  m)) ,  we  must  have  (r,  m)  ~ t  ( s,m ).  Since  sm  G  Ur/i7™,  ^,  there  must  also  be 
some  run  r'  such  that  s  G  7?.™,^.  Thus,  ( s,m )  G  U '(rCm^p  Since  X  satisfies  CONS,  we  have 
(s,m)  ( r',m ).  It  follows  that  (r',m)  ( r,m ).  Since  X  satisfies  SDP,  we  must  have  that 

=  Wcr'.m.iji  so  (s,m)  G  H  Therefore,  s  G  71^,  as  desired. 

The  modifications  to  deal  with  the  case  where  both  SDP  and  REF  are  in  A  are  identical  to 
the  case  with  UNIF,  and  are  omitted  here.  □ 
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